Large-scale Coldcard compromise (1596 BTC stolen so far)

[ryzaadit]

But if they continue selling them, I wouldn't be surprised if they can be held liable themselves if someone loses his Bitcoins from using that hardware wallet later on. I wouldn't risk it as a seller.

Yeah, he on double-sword situation in every angle and option. Either keep selling the ColdCard device, make a discounted price, or maybe trade the oldest device for the newest one and try to sell them in batches (to other resellers) and take the loss. Pretty surprising he has so much stock, usually resellers only have stock around 5-10, and their shops are always empty or only have a few products left (1-3).

Anyway, I'm digging about Bitcoin Brabant, funny thing: in 2024, he made a pool for ColdCard, but it wasn't an issue about entropy at that moment. It's about drama; nvk issued a cease-and-desist to @dsbaars for his BTClock. That action caused a big drama, especially for an open-source project, and he somehow came out with these pools.

Source: https://x.com/BitcoinBrabant/status/1857266784060968977

He has so many signs to drop the CoinKite product.
1. Retirement Attack ColdCard Topic in 2021
2. These pools drama cease-and-desist to open source project

If he just follow how the community wants, I guess he's not gonna face these situations right now.

But the community should consider them to be a complete failure as a hardware wallet company, and discourage people in and outside, of the Bitcoin/crypto community from buying a ColdCard like how the community discourages everyone from buying a Ledger.

The community will always choose not to buy or trust them. Some people suggest that Bitcoin Brabant keep selling because those devices still can be used for Multi-sig. Now did everyone still gonna to use the ColdCard device even is not for storing your assets? but just a multi-sig device?
Me still see these device scaries, even though just for multi-sig.

[greysonz]

Coldcard white hackers movement: 40.713236 BTC ($3.31M) moved in block 967948 with OP_RETURN: "claims:cryptorecoverytrust.com”

https://mempool.space/tx/38b524ccb8ca260ec705ab980982144857c477658fa39591870ee8cb09bcea47

If anyone forgot, it was reminded that it was 40 bitcoins that the white hackers managed to withdraw when they found out about the Cold Card hacking. Apparently, now they want to return these bitcoins to the owners. The only question is verification.

Cryprorecoverytrust is the site is owned by an official legal trust in the United States, registered in the state of Wyoming under the name The Recovered Digital Asset Statutory Trust of Wyoming. This trust is an independent and neutral intermediary that stands between hackers and affected users, acting as an official legal arbitrator.


https://x.com/glxyresearch/status/2102044678254215653


Upd: 52 BTC

[ryzaadit]

-snip-
Cryprorecoverytrust is the site is owned by an official legal trust in the United States, registered in the state of Wyoming under the name The Recovered Digital Asset Statutory Trust of Wyoming. This trust is an independent and neutral intermediary that stands between hackers and affected users, acting as an official legal arbitrator.

I thought the trust had been open for such a long time.
Turned out to be very new? I opened with the Wyoming Secretary of State and put their filing ID: 2026-002059293 from the site. These the information:


I guess this is why searching for them on the internet, social media, and other, can't really find so much information about them. Initial Filling: August 18, 2026 very very new (34 days) ago. People should still be aware of these, just praying all the good things for victim but also they should still sharp and carefull for everything.

They should put a warning about no cost/fee in the main page. When trying to visit the site, those warnings should be on there without needing to check to other sections. I see they put a warning in "About/Resource".


My biggest question: why choose a very new trust to handle these matters?

[greysonz]

My biggest question: why choose a very new trust to handle these matters?

You're right. I personally expressed my opinion about this website, because I see it, but hack victims are vulnerable from the start, and this is the moment when scammers can become active. Starting from the fact that this website is fake, and ending with the fact that if it is real, they can create phishing copies, which is why hack victims need to be careful with domains.
But really, why didn't the hackers choose large, trusted services with big names to transfer these 40 bitcoins?
We will  know it soon, but I think the site is legal...

Update: 52 BTC is moved

[PrivacyG]

But if they continue selling them, I wouldn't be surprised if they can be held liable themselves if someone loses his Bitcoins from using that hardware wallet later on. I wouldn't risk it as a seller.

It would be interesting if they they could then hold Coldcard liable for forcing them to sell devices that produce victims.  Coldcard is acting as if their product is the Bitcoin hype of the year so I see that possible.

[Wind_FURY]

But the community should consider them to be a complete failure as a hardware wallet company, and discourage people in and outside, of the Bitcoin/crypto community from buying a ColdCard like how the community discourages everyone from buying a Ledger.

The community will always choose not to buy or trust them. Some people suggest that Bitcoin Brabant keep selling because those devices still can be used for Multi-sig. Now did everyone still gonna to use the ColdCard device even is not for storing your assets? but just a multi-sig device?
 
Me still see these device scaries, even though just for multi-sig.

I believe that a government entity should issue an order to stop the company behind ColdCard from selling their products until the issue has been investigated and resolved. If the theory that it's actually an inside job was true, then the community in general is letting them get away with it.

It's not enough that the community would choose not to trust them and/or buy their products.

[fillippone]

Listening to an Italian podcast, they stated Whitehats announced they will release their private key so that everyone will be able to real the whole conversation.
Does anyone has any knowledge about this? It would be extremely fun!

[Wind_FURY]

Listening to an Italian podcast, they stated Whitehats announced they will release their private key so that everyone will be able to real the whole conversation.

Does anyone has any knowledge about this? It would be extremely fun!

?

Which Italian podcast is that? Is that a podcast with Giacomo Zucco and his wife Mir Liponi? I believe they're the only Italian Bitcoiners who are most popular to the general cryptocurrency community.

Plus who are those White Hats, and how many Bitcoin do they have under their custody?

[ryzaadit]

Plus who are those White Hats, and how many Bitcoin do they have under their custody?

The only one we know right now is DART - Digital Asset Recovery Technologies.

They're independent white-hat researchers, and they already share some information about how they rescue Bitcoin.
Source: https://assetrecovery.io/blog/coldcard-entropy-recovery.html.
They claim to be working with Crypto Recovery Trust for the stored of the victim fund.

I guess the update movement white-hacker for ColdCard is being shared by @greysonz could be from DART. I don't know; do we have other white-hat hackers or researchers who are helping right now with the ColdCard issue.

Currently only know DART. I checked both DART & Crypto Recovery Trust, and they're really new. I guess DART is taking this case as a pro bono case for the security portfolio of their service.

[Italian Panic]

I know this has nothing to do with ColdCard or even with that type of hack, but it seems that the Duelbits online casino has also been compromised and seven million dollars has been stolen from it; it appears that funds in various types of cryptocurrencies have been stolen.
We now have to come to terms with a situation where AI agents are able to scour websites and find vulnerabilities everywhere. It’s no longer enough just to be a good programmer; you also need to carry out rigorous crash tests using suitably designed AI agents.

[Stalker22]

I know this has nothing to do with ColdCard or even with that type of hack, but it seems that the Duelbits online casino has also been compromised and seven million dollars has been stolen from it; it appears that funds in various types of cryptocurrencies have been stolen.
We now have to come to terms with a situation where AI agents are able to scour websites and find vulnerabilities everywhere. It’s no longer enough just to be a good programmer; you also need to carry out rigorous crash tests using suitably designed AI agents.

Have you seen anything saying the Duelbits hack was linked to AI?  I havent found any news about that.  Plus, this is not even the first time their hot wallet got drained.  Something similar happened a few years back.

[Wind_FURY]

Plus who are those White Hats, and how many Bitcoin do they have under their custody?

The only one we know right now is DART - Digital Asset Recovery Technologies.

They're independent white-hat researchers, and they already share some information about how they rescue Bitcoin.
Source: https://assetrecovery.io/blog/coldcard-entropy-recovery.html.
They claim to be working with Crypto Recovery Trust for the stored of the victim fund.

I guess the update movement white-hacker for ColdCard is being shared by @greysonz could be from DART. I don't know; do we have other white-hat hackers or researchers who are helping right now with the ColdCard issue.

Currently only know DART. I checked both DART & Crypto Recovery Trust, and they're really new. I guess DART is taking this case as a pro bono case for the security portfolio of their service.

What are their terms for payment? Do they get a percentage of what they get from those wallets that weren't adequately secured?

Plus do those white-hat hacking services get licenses from the government for them to be allowed to operate? I believe not.

[joker_josue]

Currently only know DART. I checked both DART & Crypto Recovery Trust, and they're really new. I guess DART is taking this case as a pro bono case for the security portfolio of their service.

What are their terms for payment? Do they get a percentage of what they get from those wallets that weren't adequately secured?

Plus do those white-hat hacking services get licenses from the government for them to be allowed to operate? I believe not.

Don't you find it strange that these companies, despite having existed for some time and having no publicly verifiable cases of previous recoveries, suddenly appear directly involved in recovering the funds from the Coldcard hack?

It's just a question I'm leaving open. Maybe I'm seeing things where they aren't there.

[Stalker22]

Currently only know DART. I checked both DART & Crypto Recovery Trust, and they're really new. I guess DART is taking this case as a pro bono case for the security portfolio of their service.

What are their terms for payment? Do they get a percentage of what they get from those wallets that weren't adequately secured?

Plus do those white-hat hacking services get licenses from the government for them to be allowed to operate? I believe not.

Don't you find it strange that these companies, despite having existed for some time and having no publicly verifiable cases of previous recoveries, suddenly appear directly involved in recovering the funds from the Coldcard hack?

It's just a question I'm leaving open. Maybe I'm seeing things where they aren't there.

If I remember correctly, I think the reason why the Crypto Recovery Trust was created in the first place was because of the Cold Card case, once white-hat hackers were able to intervene and save some of those assets.

But it should not sound crazy for questioning it.  It is a known fact that most of these so-called "recovery firms" are total scams.  I dont mean this specific case, where the timeline actually makes sense because the group was formed right after that exploit happened.  Regardless, healthy skepticism in crypto is usually the smart move anyway.

[ryzaadit]

What are their terms for payment? Do they get a percentage of what they get from those wallets that weren't adequately secured?

Since they're sending most of the funds to be stored in trusts, the process is on these trusts' site. They're claiming they're not charging any payment, fee, or fund. That's why I mentioned pro bono in my previous post since these "Crypto Recovery Trust & DART" are mostly new, they're doing these as pro bono (no-payment jobs), just as a good gesture and maybe for the portfolio security of their service. But even they're mentioned without any payment. The victim should stay alert & sharp for the process, the first time I saw this, it also left me with a big question. You can see my few posts before.

Plus do those white-hat hacking services get licenses from the government for them to be allowed to operate? I believe not.

The legal things and stuff we can find: The trust is registered under the Wyoming Secretary of State, and they're getting created & advise by national security attorneys at Steptoe LLP. I checked Steptoe LLP; it seems they've been running for over 110 years to provide legal services.

Source
[1] https://assetrecovery.io/blog/coldcard-entropy-recovery.html
[2] https://wyobiz.wyo.gov/Business/FilingSearch.aspx

But it should not sound crazy for questioning it.  It is a known fact that most of these so-called "recovery firms" are total scams.  I dont mean this specific case, where the timeline actually makes sense because the group was formed right after that exploit happened.  Regardless, healthy skepticism in crypto is usually the smart move anyway.

That's the first thing that came to my mind at the time I saw the post from greysonz. I need to double-check with Wyoming Secretary of State and check their portfolio. It turns out the service and trust are pretty new. So, perhaps from my positive side maybe they're doing these as pro bono for portfolio but from my negative side, seeing they're pretty new these could be a scam tactics? cause they using a new trust.


Speaking about the process of refunding Victim Coldcard, 50 BTC has been rescued. Yesterday, National Security Attorneys for DART & Crypto Recovery Trust Steptoe LLP published an article claiming more than 20 BTC around $1,7M has been returned to the rightful owner.


Source: https://www.steptoe.com/en/news-publications/crypto-recovery-trust-created-by-steptoe-attorneys-returns-dollar17m-in-bitcoin-to-its-owner-after-coldcard-exploit.html

Can anyone actually confirm these? It's prety quick just a few days already refund almost 40% of the funds.

[greysonz]

Currently only know DART. I checked both DART & Crypto Recovery Trust, and they're really new. I guess DART is taking this case as a pro bono case for the security portfolio of their service.

What are their terms for payment? Do they get a percentage of what they get from those wallets that weren't adequately secured?

Plus do those white-hat hacking services get licenses from the government for them to be allowed to operate? I believe not.

Don't you find it strange that these companies, despite having existed for some time and having no publicly verifiable cases of previous recoveries, suddenly appear directly involved in recovering the funds from the Coldcard hack?

It's just a question I'm leaving open. Maybe I'm seeing things where they aren't there.

If I remember correctly, I think the reason why the Crypto Recovery Trust was created in the first place was because of the Cold Card case, once white-hat hackers were able to intervene and save some of those assets.

But it should not sound crazy for questioning it.  It is a known fact that most of these so-called "recovery firms" are total scams.  I dont mean this specific case, where the timeline actually makes sense because the group was formed right after that exploit happened.  Regardless, healthy skepticism in crypto is usually the smart move anyway.

I'm absolutely certain that DART are the good guys, and they're not anonymous and they don't take any bounty for helping return the bitcoins. And by the way, here's the latest news: They just bragged that they've already returned 20 bitcoins directly to the original owner.

[fillippone]

This is welcome news, and it in no way makes things easier for Coldcard. Even if the opposite were true, if a white hat could set up such an operation in a few hours, how couldn’t Coinkite have fixed those bugs in the weeks before?

[avp2306]

This is welcome news, and it in no way makes things easier for Coldcard. Even if the opposite were true, if a white hat could set up such an operation in a few hours, how couldn’t Coinkite have fixed those bugs in the weeks before?

Well possible solution can be done in hours but to test it? I think it requires many weeks to test if this is truly working and could help them for long term, especially those possible solution given by the white hats.

The problem with Coldcard is they didn't bother to look at the hidden flaws on their firmware. If they just made regular check ups maybe that incident will not going to happen.

But well since that incident already happen, this incident is just another expensive learning experience from them and also to the platform offering same services.

[gmaxwell]

created & advise by national security attorneys at Steptoe LLP. I checked Steptoe LLP; it seems they've been running for over 110 years to provide legal services.

Veterans of the cryptowars in the 90s may remember Steptoe as the thinly disguised proxy for the NSA that acted to try to shut down public access to strong cryptography.

It would be kinda interesting if state actors knew about coldcard (or, e.g. milk sad) in advance and had only deployed it against enemies like iran, then when the issue was blown open acted quick to rescue other users.