Large-scale Coldcard compromise (1082.65 BTC stolen so far)

[Filicius]

So I don’t think the real question is whether AI can somehow “break Bitcoin”. That’s probably the wrong way to look at it.

The more interesting question is how much vulnerable code is still sitting somewhere in the Bitcoin ecosystem, considered safe mainly because nobody has managed to find the bug yet.

My guess is that over the next few years we’re going to find out. In a brutal way, probably.

Your words are worrying, and probably reading them elsewhere would not have made too much of an impression on me, but reading them here I think it is something that we should all take into account and try to improve, as much as possible, the security of our funds. But, in cases where it is very difficult to foresee that a vulnerability would be found, how do you protect yourself?

[fillippone]

. But, in cases where it is very difficult to foresee that a vulnerability would be found, how do you protect yourself?

As an immediate answer: avoid any overhead on the simplest setup.

Self custody. Cold wallet. Signing devices are not cold wallets.
Simple and battle tested setup.
No fancy features. Prefer Bitcoin only solutions. 
Do not consolidate. Spreading bitcoins across multiple UTXO’s lowers the attacker’s ROI.

I reckon Coinkite matched a few requirement here.
I guess the “do not consolidate” is the new paradigm here.

[philipma1957]

It seems that Coldcard users have not been fully proven to be affected by the Ill Bloom vulnerability, but because there are several users affected, Coldcard's name is dragged, however, anyone who uses Coldcard here, especially those who use it before 2026, must remain vigilant, for the sake of bitcoin security, it is better to move everything to a new wallet until the origin of this theft problem is known.

Coldcard confirmed the vulnerability: https://x.com/COLDCARDwallet/status/2082961993070247948

A quick discovery. COLDCARD has also prepared a migration guide to a safer one. It's best to do this as soon as possible or move to another wallet first. Don't use COLDCARD temporarily. Although they say Mk4, Q, and Mk5 won't affect it, it could be risky.

I've never encountered a problem like this before. My question is, will COLDCARD cover the losses?

I doubt they cover losses

[Stalker22]

From Reddit:

All the affected addresses contained more that 0.15 BTC at the time of the transactions.
~
Theft address has consolidated most of the funds in bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r.

I checked this address, and the 0.15 BTC threshold seems to be correct. I expect the number of addresses holding lower amounts to be much larger than the currently swept addresses, and I expect a brute-force weak key attacker to already know the keys to those addresses. So that brings the question: why leave anything under $9500 untouched? I've never seen that before in any hack!

I cant say I fully understand the technicalities or how the attacker exploited the flaw in the Coldcard firmware, but just looking at the block explorer, it is obvious they went after the high-value addresses first.  Even though most transactions happened in a short window, there is still a lag between them as they got confirmed across several blocks.  My guess is the attacker doesnt have instant access to all affected keys and needs serious compute power to generate them, so they are prioritizing the richest addresses first (if that makes any sense).

[eaLiTy]

~
So I don’t think the real question is whether AI can somehow “break Bitcoin”. That’s probably the wrong way to look at it.

The more interesting question is how much vulnerable code is still sitting somewhere in the Bitcoin ecosystem, considered safe mainly because nobody has managed to find the bug yet.

My guess is that over the next few years we’re going to find out. In a brutal way, probably.

I am not particularly worried about the core BTCitcoin, as every proposal is picked apart and scrutinized by hundreds of developers. It is true about the surrounding ecosystem, and I have no doubt there will be a race between those ecosystem developers and the bad actors to find vulnerabilities in the coming years.

~
You didn't steal from a wallet.
You stole from a family

No words bro, stay strong.

[flatfly]

Updated total drained: 1082.65 BTC

@glxyresearch

We mapped the flow of funds for the Coldcard vulnerability based on the pattern identified by engineers at Block and shared by
@clay_garrett
 

1,196 addresses drained in full for 1,082.65 BTC (~$70.2M) between 01:10:20 and 01:51:26 UTC on Jul 30 — a 41-minute window, blocks 960,183-960,191. That preceded the hardware-wallet vendor's public advisory by ~30 hours.

Signature: every sweep paid an identical hardcoded 30.0 sat/vB — a 30-75x overpay vs the 0.4-1.0 sat/vB median that week — and left no change output. That looks like an automated tool spending keys it already held, not owners moving funds. Victims: 1,183 native segwit (BIP-84), 7 BIP-49, 6 BIP-44 — consistent with multi-path key scanning.

Proceeds consolidated within minutes and have NOT moved since:
- bc1qq85v2c9...cu9r — 562.02 BTC
- bc1qx76cae2...fhe3 — 398.48 BTC
- bc1q8jy96fe...tp3q — 89.62 BTC
- bc1qnk4zh9q...fecp0 — 32.45 BTC (unmoved)

[sunsilk]

Thank you very much for your kind words. They genuinely mean a lot to me.

You're probably right. Someone willing to steal life savings is unlikely to suddenly have a change of heart. Still, I felt that if there was even the smallest chance my message could reach them, it was worth trying. I think I would have regretted staying silent more than writing the post.

My family is the reason I'm still fighting. There are days when this feels overwhelming, but giving up isn't an option. I have to keep moving forward for my son.

I also appreciate you mentioning the drafts page and suggesting I repost it in the Hardware Wallets board. I'll definitely check if I still have a copy there. Thank you for taking the time to read my story and for offering both your encouragement and practical advice. I truly appreciate it.

Virtual hugs to you bro.

I've read your story and it touched me, I cannot imagine how I'll react if I am in your shoe. No one deserves to be in that situation.

There will be the time reckoning for these heartless monsters. The forum is with you in these hard times.

Coldcard tweeted to "migrate carefully". I don't know what to say if the hardware designer tweets that. It scares me tbh.

[philipma1957]

Well After reading this thread I have decided to scale back my BTC holdings.  If it is a big deal and if AI routinely attacks and beats safety measures as this was obvious AI crypto will tank like mad.

I do not need too much exposure in the space. I sold about 30% of my coins today.

[Iranus]

A video from two years ago has resurfaced in which this bloke warned about the ColdCard system and its vulnerabilities.

https://www.youtube.com/watch?v=oj_W3xOlt6U

Yesterday’s attack targeted the ColdCard Mk3 (40 bit), but this video also highlights issues with the Mk4 (72 bit).

I watched the video.
Was this also a firmware bug?
In this case, was the device itself generating a weak seed like MK3? Or is there some other bug? As far as I understood from watching the video, if someone uses enough dice rolls, there shouldn't be a problem.

I saw in ColdCard's official post that there was no problem with Mk4, but this video shows that MK4 also has bug. If this is the case, then no version of coldcard should be trusted anymore?

[Pmalek]

I've never owned a Coldcard, but have used hardware wallets. One of the things I dislike about them is the "black box" feeling it gives me: I have no idea what it's doing in there, and I basically have to trust the manufacturer (and some reviewers). And "trusting" is what I don't like when it comes to Bitcoin.

Unless you can code or know how to read and interpret code, trust is sadly an integral part of so many systems nowadays. Even if they are open-source. Consider the code change that the Coldcard team did back in 2021, which resulted in seeds being generated with weak entropy. The code has been available for public scrutiny for 5 years and no one ever found it. Coldcard isn't open-source but its code is publicly verifiable. No security expert found the vulnerability.

Hardware wallets are black boxes and so are our phones and computers. Who knows what kind of vulnerabilities exist in other bitcoin software and hardware that we rely on and just like with Coldcard, no one has found them or discovered a way to take advantage of them yet.

[Karl_3000]

I saw in ColdCard's official post that there was no problem with Mk4, but this video shows that MK4 also has bug. If this is the case, then no version of coldcard should be trusted anymore?

They are all affected but Coldcard MK3 is mostly affected.

https://bitcointalk.org/index.php?topic=5589975.msg66996917#msg66996917

[decodx]

I saw in ColdCard's official post that there was no problem with Mk4, but this video shows that MK4 also has bug. If this is the case, then no version of coldcard should be trusted anymore?

According to their security advisory, the vulnerability impacts the following models and firmware versions:

• Coldcard Mk3: Firmware version 4.0.1 or later
• Coldcard Mk4 & Mk5: Firmware versions prior to 5.6.0
• Coldcard Q: Firmware versions prior to 1.5.0Q

You can read here for full details: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/

[Swordsoffreedom]

Well After reading this thread I have decided to scale back my BTC holdings.  If it is a big deal and if AI routinely attacks and beats safety measures as this was obvious AI crypto will tank like mad.

I do not need too much exposure in the space. I sold about 30% of my coins today.

wth, do you really think AI can  crack private key? This Coldcard issue or any of the recent exploits have nothing to do with AI "breaking safety measure". In most cases, these are caused by our errors. Maybe supply chain attack or firmware vulnerabilities or bad implementation.

AI is just a tool, I dont think it can brute-force an ECDSA private key, at least with current technology.

[joker_josue]

Sorry, but I couldn't understand what the bug itself is and how they manage to steal the coins

Can they find out the seeds of the addresses? But how do you know, what are the addresses generated by this wallet?

Anyway, I still can't quite understand how this situation works... 

[mr.mister]

Unbelievable what has happened. I own both a Coldcard Mk4 and a Q. I appear to be unaffected by this specific flaw because I used sufficient dice rolls to generate my seed, but I feel terrible for the victims.

What I cannot understand is how nobody discovered this earlier. On the affected Mk3 firmware, seeds were reportedly generated with only about 40 bits of entropy. On the Mk4, Mk5 and Q, entropy could be as low as approximately 72 bits.

Seed generation is arguably the single most important part of a hardware wallet’s source code. How could such a fundamental flaw remain undetected for years and then be carried across several generations of devices?

I am waiting to hear Coinkite’s full explanation—not only how the error happened, but why its internal review, testing and external scrutiny failed to identify it. I also want to see how the company responds to the victims.

Even though my own wallet appears unaffected, I am seriously considering abandoning Coldcard. My decision will depend heavily on the quality and transparency of Coinkite’s response, and on what it does for those who lost their funds.

[mr.mister]

Well After reading this thread I have decided to scale back my BTC holdings.  If it is a big deal and if AI routinely attacks and beats safety measures as this was obvious AI crypto will tank like mad.

I do not need too much exposure in the space. I sold about 30% of my coins today.

wth, do you really think AI can  crack private key? This Coldcard issue or any of the recent exploits have nothing to do with AI "breaking safety measure". In most cases, these are caused by our errors. Maybe supply chain attack or firmware vulnerabilities or bad implementation.

AI is just a tool, I dont think it can brute-force an ECDSA private key, at least with current technology.

No, I do not think AI “cracked” Bitcoin private keys or broke ECDSA. A properly generated 256-bit private key remains computationally out of reach.

The possible role of AI is completely different. AI could have helped an attacker review the publicly available firmware, trace the seed-generation code, identify that the wallet was producing seeds from a drastically reduced entropy space, and then assist in writing or optimizing the tools needed to exploit that flaw.

In this case, the attacker would not be searching the full 256-bit private-key space. They would be reproducing the much smaller set of seeds that the defective firmware could generate—about 40 bits in the worst Mk3 case and potentially around 72 bits on later models—then deriving standard Bitcoin address paths, checking those addresses against the blockchain, ranking the funded wallets and automatically creating sweep transactions.

AI could also help with code analysis, firmware emulation, debugging, parallelization, derivation-path scanning and automation. None of that means AI defeated Bitcoin cryptography. It means AI may have helped discover and exploit a serious implementation error created by humans.

There is currently no proof that AI was actually used, so that part remains speculation. But saying AI could have played a role is not the same as claiming it brute-forced an ECDSA private key.

[KiaKia]

Well After reading this thread I have decided to scale back my BTC holdings.  If it is a big deal and if AI routinely attacks and beats safety measures as this was obvious AI crypto will tank like mad.

I do not need too much exposure in the space. I sold about 30% of my coins today.

Looks like a trap to me, the podcast I still listened to yesterday was all about some event that needs to happen for Bitcoin to go even way down than people expected, while this man was been asked what it could be, he said who knows?

An evil catalyst that will make sure that people lost money, while many many people are comparing Bitmart and few others dead Cex to FTX collapse it's not really the same.

I guess this was what he is expecting? Now I have so many doubts with this crypto thing, like the timing and everything? No shit, conspiracy theory shit going on here, ..

[free-bit.co.in]

Sorry, but I couldn't understand what the bug itself is and how they manage to steal the coins

Can they find out the seeds of the addresses? But how do you know, what are the addresses generated by this wallet?

Anyway, I still can't quite understand how this situation works... 

There was a serious bug in the device's or software's RNG. As a result it does not generate completely random numbers. Rather, it relied on predictable pattern or weak entropy source while generating seed phrase or private key.

Because of this the keys generated here were not unique enough. Attackers may have pre-calculated or brute-forced the predictable range of seeds generated by this faulty algorithm! So they don't need to find wallet address one by one.

[PostQuantumBTC]

Sorry, but I couldn't understand what the bug itself is and how they manage to steal the coins

Can they find out the seeds of the addresses? But how do you know, what are the addresses generated by this wallet?

Anyway, I still can't quite understand how this situation works... 

Cold card is using physical chip STM32 hardware RNG to generate entropy but there was a Coldcard update in 2021 that bypassed it and use MicroPython's deterministic Yasmarang fallback to generate the entropy. The security of the seed phrase generated from the entropy is weak and not up to 128 bits.

If you want to understand more about it, you can read this https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware

[Ambatman]

This would hurt more than we might expect

The trust associated with cold storage, airgapped and the likes is strained 

Now many would have to reconsider and ask how sure are they that their funds are really safe.

Random generator is only random till it isn't.

Seedphrase with great entropy was okay then now we need paraphrase, multisig

And don't place all your coins in one basket ( Which should be common knowledge by now)

At the end, Nothing is truly safe.

The cost and lesson from this vulnerability is very much expensive

And not the first time we having issues with seedphrase generator with claimed randomness.

I guess Randomness is the foundation and When it fails
air-gaps, metal backups, multiple Backup cannot fully save you.