Large-scale Coldcard compromise (1128.47 BTC stolen so far)

[Italian Panic]

It appears that some versions of the Coldcard MK4 and MK5 are also partially compromised, having generated seeds with 72 bits of entropy instead of the standard 128 bits. This could be another major flaw in the Coldcard system that should not be overlooked.

One thing is certain: unfortunately, today we have witnessed a dark chapter in the history of Bitcoin, perhaps the darkest yet, given how it unfolded and how defenceless it left us.

I don’t use ColdCard, thank goodness, but I must say I won’t be sleeping soundly tonight, despite all the precautions I have taken for my wallet (offline keys, device always offline, private keys stored offline, etc.).
This was not a leak of private keys, or phsicological engineering, they solved the algorithmic and entropic structure under this bitcoin seed generator for a little error in a source code, in AI era, it's absurd.

I think I don't sleep soundly for some nights. Bitcoin is the dream that Satoshi gift to us, we must do everything we do to preserve it.

Maybe it’s time to think of something new for preserve the self custody.

[bitmover]

I do not need too much exposure in the space. I sold about 30% of my coins today.

I understand and I feel this fear as well.

But good investors need to control their emotions. There isnt a real need to sell your coins now , you are being controlled by emotions. Selling now when the price is down, you will pay taxes, etc... not a good time to sell

You can move your coins to a better wallet and use a passphrase..
Bitcoin is safe.

[Cricktor]

...

BIP-39 derivation is deterministic. If the starting entropy is weak and therefore prone to be reasonably "easy" to guess, everything else that comes after the initial entropy in the deterministic derivation process falls apart.

If an attacker can brute-force such a weak entropy as what nvK's stupid firmware code generated, basically all two billion (2³¹) private keys of a wallet derivation path are compromised (surely it's not likely that a wallet has ever used up a derivation path to its limits).

Anyway, it's a desaster of a lunatic open-source foe (yes, @nvK, it's your or your programmer's fault, likely hastily removing as much as possible and as quick as possible GPL code). It doesn't help all those wallet drainage victims who lost coins due to this terrible acting. And I'm very much sure, nvK won't take responsibility for this desaster, at least not in any way that would help victims.

To a huge extent it seems paper backups remain the best.

Did you really mean "paper backups" like backups of mnemonic recovery words? If yes, that doesn't make sense, because recovery words represent the more or less random initial entropy in a human readable form. If the entropy is weak, the paper backup doesn't magically make it better or more secure.

If you meant "paper wallets", it doesn't really make more sense. A paper wallet is only as secure as its private key is random. It doesn't hide the private key reasonably well. It doesn't provide all the functionality of a real wallet. And with all the challenges to securely generate "good" paper wallets, I would put those to outdated things of the past.

Paper wallets have niche use cases and should only be used if you really know what you're doing.

I don't think this is good advise, to be honest.

As for the AI talk I don't think there's any direct relationship at the moment however if it turns out to be a quantum related attack they you might be able to link it to AI.

It may feel like I'm nitpicking on you, but frankly, why do you bring up the "quantum" word? For what reason, seriously? The gravity of this desaster isn't a playfield for bullshit bingo.

...

Interesting! I like it, when thieves make mistakes. Adds a piece to the theory that the attacker could've vibe (LLM) coded his nefarious tools. Why not have an own full-node and block explorer instead of using a paid block explorer service. That's embarrassing...
If it makes the thief get pinned down, all good.

[philipma1957]

I do not need too much exposure in the space. I sold about 30% of my coins today.

I understand and I feel this fear as well.

But good investors need to control their emotions. There isnt a real need to sell your coins now , you are being controlled by emotions. Selling now when the price is down, you will pay taxes, etc... not a good time to sell

You can move your coins to a better wallet and use a passphrase..
Bitcoin is safe.

I gave most of my btc to my wife.

I sold the btc in my custody.

All my btc was purchased this year.

I sold it at a small loss.

I made a write off thus no tax.

I can't afford exposure to a large price drop.

The sale frees me up and if this taps the market out to 35k my wife can buy some.

[Synchronice]

I'm really shocked that this happened to Coldcard, I always thought that this was the best crypto wallet, the most secure one and I was supporting Coldcard over Passport when it was about security (but in general I was suggesting passport for a better user interface and experience).
Anyways, I think that this was a huge hit to hardware wallets because the security of Coldcard was thought to be one of the best if not the best.

I stick with my electrum and airgapped computer!

P.S. Thanks theymos for sticking this thread on the main page of the website.

Everyone affected should not throw away or smash their Coldcard devices is here why.
https://x.com/zherbert/status/2083261221726220638?s=20

I wonder what happens if someone didn't declare their coins and law enforcements manage to recover lost coins.

[DaveF]

I do not need too much exposure in the space. I sold about 30% of my coins today.

I understand and I feel this fear as well.

But good investors need to control their emotions. There isnt a real need to sell your coins now , you are being controlled by emotions. Selling now when the price is down, you will pay taxes, etc... not a good time to sell

You can move your coins to a better wallet and use a passphrase..
Bitcoin is safe.

I gave most of my btc to my wife.

I sold the btc in my custody.

All my btc was purchased this year.

I sold it at a small loss.

I made a write off thus no tax.

I can't afford exposure to a large price drop.

The sale frees me up and if this taps the market out to 35k my wife can buy some.

As the saying goes you have to do you.
Ignore the people who are telling you otherwise.


Having nothing to do with anything else (coldccard hack, state of BTC, everything else in the world) I have been slowly liquidating a bunch too.

Just wanted to diversify.


Back to this.  Sort of.

Pure human screwup. But, it's been out there for the public to see for years now, just took this long for someone to catch it.
Seeing the vulnerability of the day that has been popping up in things like the linux kernel, PHP, SSH and everything else. I'm kind of surprised it took this long for someone to find something wrong with some hardware wallet.

-Dave

[F2b]

I totally get that the current situation is frightening and concerning, and it's right that Coldcard users must act quickly to save what can be saved.
However, for users not directly affected (or even for those who are), let's not give in to panic. I'm definitely not a security expert, and I don't usually post on this forum anymore, but because one company failed to secure their product correctly doesn't mean we should start applying so-called "best-practices" blindly. A person's setup should always be tailored to their specific situation.

Is polymerbit also a Cold type of ring? Should I be afraid?

Polymerbit [...] uses keys generated offline and printed on a sort of polymer banknote with a holographic layer. I don’t see any issues if you trust the people who created them, if you trusted them before, you can continue to do so.

The green part is true. But that doesn't make it safe. They are very nice collectibles, not security devices. Trusting someone else to generate a seed / private key for you is worse than using a software hot wallet, which is in turn worse than using any good HWW (i.e. not Coldcard).

Here's what's safe:

1. Generate your own seed and do it right. 100 dice rolls, or, do it manually using something like Entropia Tablets (a jar filled with seed words printed on pill-shaped plastic). You'll need a hardware wallet to generate the final word (the checksum). This isn't a security issue since the last word for a 24 word seed phrase will be one of 7 or 8 words that can mathematically form a valid checksum. Generating your own seed means there's no chance borked code can cause your seed phrase to be vulnerable.

This is safe in theory. Then in practice, your dice might not be perfectly balanced. And most importantly, this introduces potential for human errors. The main cause of lost bitcoins is, by far, user error; so I wouldn't trust a human to generate a seed by himself.
The combinaison of the entropy generated by a hardware wallet + dice rolls seems like a better alternative to me.

At this point it's so bad that you can't even trust hardware related storages anyone to the fullest. To a huge extent it seems paper backups remain the best.

The usage of a HWW and paper / metal backups are complementary. Regardless of the setup, there should always be a backup / a way to recover funds in case either the HWW or the seed backup is lost.
I hope you're not talking about the paper wallets from the good old days, that were generated using a web app, had a single key pair (unlike modern HD wallets), where we scanned the private key QR code into a hot software wallet. Those are obviously not very safe compared to modern standards.

3. Use a passphrase or multisig. As seed phrase hunters churn through billions of seeds, if they generate and test yours, they'll never know because your seed by itself generates a wallet that's never been used. If you're using a passphrase, write it on paper. Make a metal backup. Store it separately from where you store your seed. If you're doing multisig, document your work every step of the way and store that separately from your seeds.

This is probably the piece of advice I've seen the most today. It's good that you reminded people that having a passphrase or a multisig requires to have proper backups of the passphrase / keys.
Again, passphrases can be a great tool if used right, but it often gets recommended without proper guidelines, ending in users:
- choosing passphrases with weak entropy (like a single BIP39 word, or anything generated by a human really)
- not backing it up correctly (trying to remember it, or having only one copy of the passphrase)
Plus, a passphrase doesn't have a checksum: if you make a typo when entering it, you just end up with an empty wallet, wondering where your funds are.

So yes, a passphrase may be a good idea, but only if done correctly, and I'm convinced that a lot of users do it in rather unsafe ways.

Multisigs seem like a much stronger option, and to me it's the only really safe option once you start having substantial amounts (the exact amount depending on what is substantial to you, ofc). But as said, it requires a bit more time and knowledge. This is the only solution that allows to spread the seeds / devices geographically, secure the different seeds with different methods (countering different potential attack vectors) and not trusting a single hardware device / manufacturer.

This Coldcard bug is really a shame, as some users will be tempted to give up on self-custody, or use unsafe setups. Because Coldcard fucked up doesn't mean hardware wallets aren't useful.

P.S. I'm not trying to minimise what's happening. This is terrible, and the implications are deeper that what most people think. For example in terms of confidentiality, if you manage to save your funds from a vulnerable Coldcard, once it gets compromised the attacker can still link all your UTXOs together, i.e. reconstitute your whole on-chain history. This also weakens coinjoins Coldcard users were implied in, etc.

[philipma1957]

To me the biggest issue is will this crash prices bigly or not.

I safe guarded myself by doing this sale.

USA tax law has some good tax benefits if you are married.

I took advantage of them.  I freed up a good chunk of change all based on 2026 purchases.

So if the market crashes and burns I have cash.

My wife can stack some cheap corn if she wants to do so. If price drops to 35k as some now think is a mortal lock.

[PrivacyG]

My guess is that over the next few years we’re going to find out. In a brutal way, probably.

This is such a great thought provoking response.

And it makes me really wonder if particularly to prevent these types of situation it would not be better to move on or at least have the option to choose a less Firmware dependent generation of Seeds where true random ness is applied.

For example.  Shipping Hardware Wallets with small dice and either replacing automated generation with a guide to manually generate your own Seed or at least providing the choice of doing so.  When done properly, I can not think of any risks this method may have.

It is true that, while I heavily disagree with Artificial Intelligence, in some situations it is REALLY helpful, faster and can find patterns way better than a couple human brains can do.  And this is before Organoid Inteligence becomes the hype, which I am thinking will be a lot scarier than Artificial Intelligence currently is.

And for that reason, it is clear that WE will have to move on together with technology and this may mean 'migrating' from old to new every now and then.  We already moved on from DAT files to Seeds, from Native to SegWit, from simple Seeds to Pass phrases and complicated Multi Sig setups and Quantum Computing is definitely going to be another reason to 'upgrade' again.  It is what it is and hopefully none of us falls victim to future such catastrophes where old vulnerabilities are found and exploited in the clear detriment of particular Bitcoin owners.

-----

My heart dropped reading the victim note and I have the very little hope that the attacker will think again and be probably the first large scale attacker in our Bitcoin history that does the unthinkable and returns what was stolen.

There is always time to do the best I guess, although I am not sure how this could work considering a simple return could mean the immediate theft by someone else who is waiting like a shark particularly for a re funding of the same Addresses that were exploited.  Just like some sharks leave a 24 out of 7 running computer that waits for exposed Private Keys and Seeds to be funded and automatically fights to be the first to take what ever funds are received by them.

[stompix]

Sorry, but I couldn't understand what the bug itself is and how they manage to steal the coins
Can they find out the seeds of the addresses? But how do you know, what are the addresses generated by this wallet?
Anyway, I still can't quite understand how this situation works... 

Since everyone is just giving you the same tech explanation, here is the short version

- Coldcard was supposed to generate cryptographically random seeds
- Bug in software made it generate non-random seeds
- Once hackers found that they could search for seeds in a less variable environment

A not-so-good example but close enough would be like asking a stranger on the internet:
- Guess what number plate combination I spotted today,?
or
- Guess what number plate I spotted today in Florida, it has 7 letters, and it's sexist.

Well After reading this thread I have decided to scale back my BTC holdings.  If it is a big deal and if AI routinely attacks and beats safety measures as this was obvious AI crypto will tank like mad.
I do not need too much exposure in the space. I sold about 30% of my coins today.

Phil, you're overreacting!
AI didn't beat safety measures, those safety measures were poorly implemented.

[bitbollo]

I am really sorry for seeing these huge losses.
One of the best ever guides on how to make a safe cold wallet, can be found on glacierprotocol.org
Even if you are not paranoid enough and don't want to follow the long explanations and proofs of concept, a read is well deserved and somewhat inspiring on how to have the best setup for your coins (based also in your current usages).
About this specific case, what is the sense to collect all these funds in the same wallet/address? This could lead potential to a kind of reimbursement by thief? In this case the company has always offered a kind of insurance available to the users?

[omenswap]

https://x.com/Rob1Ham/status/2082896614218203616

[EDIT]

Vendor advisory post:
https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/

Technical deep dive:
https://blog.coinkite.com/entropy-technical-backgrounder/


From Reddit:

Hoax__

It doesn't appear to be an isolated theft. The receiving address 'bc1qnk4zh9qcnap2mycp56qjrgza3cc8ylrh8fecp0' has received about 594 BTC (approx $37.8M) from 500 different addresses in a 15 min window (between 01:31-01:56 UTC 30/07/26). Many of the other sending addresses have been dormant for years, similar to your address. All the affected addresses contained more that 0.15 BTC at the time of the transactions.

The only way to issue a sending transaction is to have the associated private key/seed phrase. For the volume of address suspected to be compromised there could be two potential attack vectors. Either be a supply chain attack, when the hardware device purchased was compromised. Or it could be a cryptographic flaw within the hardware device where the device generates users seed phrases in such a way that an attacker could predict them, similar to the Ill Bloom vulnerability from earlier in the month.

Theft address has consolidated most of the funds in bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r.

So did Coinkite just not have an independent code audit done? It's never enough to just have the source publicly available, especially if there's a limited amount of eyes on it like this project.

[goldphysicalbitcoin]

We should use an offline, open-source wallet to generate the seed and then import it into a hardware wallet for signing. Hardware wallets have truly broken our hearts.

To me the biggest issue is will this crash prices bigly or not.

I safe guarded myself by doing this sale.

USA tax law has some good tax benefits if you are married.

I took advantage of them.  I freed up a good chunk of change all based on 2026 purchases.

So if the market crashes and burns I have cash.

My wife can stack some cheap corn if she wants to do so. If price drops to 35k as some now think is a mortal lock.

I do not believe the price will drop; Bitcoin itself remains secure. The security vulnerability affects only an obscure, older hardware wallet model. While this is a significant negative for the hardware wallet industry, its impact on Bitcoin is negligible. The future of hardware wallets will likely require the inclusion of vulnerability insurance.

[BlackHatCoiner]

If Coldcard knew about this (presumably), I'm thinking what could they have said to protect the victims? This is a critical vulnerability that targets cold storage users, something that hasn't ever occurred before, if I'm not mistaken.

I remember there was an Electrum vulnerability that directed the users to download a malware, but airgapped users were unaffected. This particular case must be unique, and I'm curious how the Coldcard team could have informed the victims without revealing to the attackers the source of the problem (so they could take advantage immediately.)

[NotATether]

If Coldcard knew about this (presumably), I'm thinking what could they have said to protect the victims? This is a critical vulnerability that targets cold storage users, something that hasn't ever occurred before, if I'm not mistaken.

I remember there was an Electrum vulnerability that directed the users to download a malware, but airgapped users were unaffected. This particular case must be unique, and I'm curious how the Coldcard team could have informed the victims without revealing to the attackers the source of the problem (so they could take advantage immediately.)

This particular bug comes from a weakened entropy source. They used some Python-based RNG instead of their on-device more secure hardware RNG by accident while replacing the GPLv3 code (their obsession with GPL is ultimately what sunk them in the end).

You remember Randstorm, right? Same idea. This is what Randstorm would've been like if lots of people were using old wallet software from <2016.


Good news for people who were drained - they appear to have found the identity of the attacker

1/ During our investigation of the Coldcard drain yesterday, we identified an unusual pattern in the sweeps. That pattern led us to a hypothesis that has since been confirmed: the operator used a paid account at a well-known blockchain-services provider to query the source addresses and perform other related activity during the sweeps.

2/ We contacted the provider directly. Their internal logs matched the suspected workflow with extraordinary specificity, including the number, timing and sequence of requests. The provider was supplying its standard services in response to requests that did not reveal their broader purpose. We have seen no evidence that the provider knowingly participated in or facilitated the suspected theft.

3/ We are sharing the relevant information with the appropriate authorities. We will provide further updates when doing so will not interfere with the investigation.

[flatfly]

Updated total drained: 1128.47 BTC

[LoyceV]

Good news for people who were drained - they appear to have found the identity of the attacker

Even if funds are recovered by authorities, how are they ever going to return them? The addresses they came from are compromised, and it would be possible for anyone who brute-forces the keys to claim ownership of the funds.

the operator used a paid account at a well-known blockchain-services provider

That just doesn't make sense! Anyone with the skills to pull this off shouldn't make such a rookie mistake, unless the account is owned by a scapegoat.
Or could it just be an amateur who's in way over his head? Someone who accidentally stumbled upon this weakness, and suddenly ended up with $70 million in stolen funds?

[Outhue]

To me the biggest issue is will this crash prices bigly or not.

I safe guarded myself by doing this sale.

USA tax law has some good tax benefits if you are married.

I took advantage of them.  I freed up a good chunk of change all based on 2026 purchases.

So if the market crashes and burns I have cash.

My wife can stack some cheap corn if she wants to do so. If price drops to 35k as some now think is a mortal lock.

I knew something like this would happen, something this cruel must happen for Bitcoin to make a new low this year, and I guess this is the bottom/bottom in motion, I'd do the same if I were you, so don't care at all what anybody says, it's yours and your decisions is only thing that matters, I've been saying that the bottom isn't in for a long period of time now, even though with my few dollars DCA every week I kept some Fiat aside for a bigger dump but everything feels too good, my question is why now? How come the team of Coldcard don't know that the vulnerability was there all along? The ugliest thing I heard from people is that some people have to lose big for some others to make it big, I don't want to believe that all this just happened, and they choose this moment of all months? It is well.

[NotATether]

Even if funds are recovered by authorities, how are they ever going to return them? The addresses they came from are compromised, and it would be possible for anyone who brute-forces the keys to claim ownership of the funds.

I don't think it will be possible without KYC.

the operator used a paid account at a well-known blockchain-services provider

That just doesn't make sense! Anyone with the skills to pull this off shouldn't make such a rookie mistake, unless the account is owned by a scapegoat.
Or could it just be an amateur who's in way over his head? Someone who accidentally stumbled upon this weakness, and suddenly ended up with $70 million in stolen funds?

Well if it's an amateur doing all this (he used AI for the exploit so can't be a professional hacker), then chances are, we are going to see a law enforcement announcement sooner than we think.

[BlackHatCoiner]

Well if it's an amateur doing all this (he used AI for the exploit so can't be a professional hacker), then chances are, we are going to see a law enforcement announcement sooner than we think.

What is the evidence that he used AI?