The crypto assets world was suddenly stirred up in the middle of the night. At 2:17 AM, the on-chain monitoring system suddenly erupted, triggering 22 alarms. These alarms indicated that funds from 22 Bitcoin addresses were transferred, totaling 40,142 BTC, worth approximately $2.43 billion.

However, what is truly shocking is the method of this transfer. The addresses used are all known P2WPKH scripts, but the signatures do not come from the original holders, but rather are generated by new private keys controlled by the U.S. Department of Justice. This discovery immediately triggered an in-depth investigation by industry experts.

The survey results are chilling. The 22 attacked addresses were all created between 2020 and 2021, using older versions of certain wallet applications. These versions employed a weak random function, with a random entropy of only 112 bits, far below the 128-bit security standard. This means that with just $32,000 spent on cloud computing resources, it is possible to reproduce the private keys in just four days through brute force enumeration. This method of attack is less a hack and more an advanced "password guessing."

More worryingly, on-chain data shows that there are 1,867 addresses using the same weak random algorithm, with an unliquidated balance of up to 78,940 BTC, equivalent to approximately 4.7 billion USD. Of these funds, 57% have been transferred to exchanges, while the remaining 43% are still "asleep" in the original addresses, facing the risk of being "predicted" at any time.

In the face of this severe situation, industry experts have proposed two security recommendations: first, to migrate funds to an offline, true random environment with an entropy value exceeding 256 bits, such as using dice to generate random numbers and performing offline signatures; second, to abandon the mnemonic phrases automatically generated by hot wallets and instead adopt hardware wallets combined with passphrases to achieve physical isolation and artificially increase entropy.

In the world of Crypto Assets, a private key is equivalent to an asset, and the strength of randomness is directly related to the security of funds. Many investors have begun to take action by transferring significant amounts of funds to cold wallets and even destroying old devices that may pose security risks. This incident has undoubtedly sounded the alarm for the entire Crypto Assets community, reminding all participants to reassess and strengthen their security measures.