At two o'clock in the morning, the phone screen suddenly lit up—an on-chain monitoring tool was going crazy, with 22 transaction records flooding the screen in an instant. Over 40,000 mainstream tokens were collectively transferred, amounting to nearly 2.4 billion dollars.

Strangely enough, the transfer rights of this batch of assets are not in the hands of the original holders.

The U.S. Department of Justice obtained the private keys for these addresses, not through traditional hacking or phishing methods, but by "brute-forcing" with computing power. No social engineering scams, no malware injections, just pure mathematical brute force. This news woke me up completely.

Having been in the circle for eight years, this is the first time I've encountered such a situation. I quickly contacted technical friends to verify the situation, and after toiling until dawn, I finally figured out the crux of the matter:

The addresses that encountered issues in this batch were created using old versions of wallets between 2020 and 2021. Which specific versions? imToken 2.8.1 and Trust Wallet 5.14—yes, these two versions that have already exited the historical stage. They have a fatal design flaw: the strength of the random number generator is insufficient, and the entropy only reached 112 bits.

Some may think that 112 bits sounds quite large. But the problem is that the industry-recognized security baseline is 128 bits, while the top standard is 256 bits. How exaggerated is the gap in between? To give an analogy: 112 bits is like using an 8-digit numeric password, whereas 256 bits is equivalent to a 32-character mixed string—uppercase, lowercase, numbers, and symbols all included.

A technical team has tested: by renting cloud computing power and investing around $32,000, it is possible to traverse the combination space of 2 to the power of 32 within an acceptable time. In other words, this level of "protection" is virtually useless in the face of professional equipment.

This incident has sounded the alarm for everyone—don't think that keeping assets in a cold wallet is foolproof. If the underlying tools have flaws, no amount of caution will help. Quickly check the version of the wallet you are using; upgrade it if necessary and don't hesitate to migrate if needed. After all, if something goes wrong, it will be too late for regrets.