Coldcard Mk3 honeypot tests show that attackers still prioritize the easiest wallets to crack

Bitcoin News posted on the X platform that new community honeypot tests show that attackers are still prioritizing wallets that are most easily exploited due to the Coldcard Mk3 RNG vulnerability.

Researcher @ColeTU injected funds into 5 affected Mk3 wallets: 1 using only the vulnerable mnemonic, 3 protected by BIP39 passphrases of 1, 2, and 3 words respectively, and another using a random account number. After 14 hours, only the unprotected wallet using just the mnemonic had its funds transferred away. According to @jamesob's real-time tripwire dashboard, currently only 2 out of 17 honeypot wallets have been emptied. The emptied wallets have been confirmed not to have added extra entropy, while all wallets protected by dice rolls, passphrases, multisig, or other complexities remain untouched.

The test results indicate that attackers are currently focusing on the wallets that are easiest to brute-force rather than investing resources in strengthening targets, but affected users should still migrate their funds immediately instead of relying on temporary protections.