Large-scale Coldcard compromise (1596 BTC stolen so far)

[joker_josue]

He could have stealing 5-10 bitcoin per month for a few months, nobody would have noticed and blamed coldcard.

It could be done, but that would require planning. Something that, in my view, seems not to have existed.

He continued with the feeling that he had found a possible flaw, and he ran a script that automatically transferred all the balance found. He was "lucky" that the first finds involved hundreds of BTC, not just a few dozen. He was ecstatic, and between that excitement and what I'm doing now, the script keeps running and generating more and more BTC.

I'm not saying this justifies action, only that the hacker himself was surprised by the success and didn't know what to do, leaving no room to create a plan beforehand.

~

This is all pure speculation.  There is nothing to back up the idea that an attacker of this level is sitting around sweating, or taking advice from ChatGPT.  On what basis do you make such assumptions?

Of course, we're all speculating. But, based on the behavior, it's clear there was no planning involved regarding what to do with the stolen coins. This is not typical behavior for most hackers looking to steal bitcoins.

Time was crucial for "cleaning" these coins. If the robbery had been well planned, he would have started cleaning them minutes or a few hours after stealing the coins. But instead, he continued hoarding everything at the same addresses. Until the theft was discovered and became public.

From the moment this type of theft becomes public, all identified stolen coins are placed under a very high and rigorous level of surveillance. It is very difficult now to hide hundreds (thousands) of bitcoins quickly and effectively.

Any strategy that is applied, even on a small scale, will be exposed in detail, making its continuation difficult. That's why, after almost a month, everything remains practically the same. The more time passes, the worse it gets, because more resources will be allocated to monitoring those BTCs.

The Bitcoin community is known for being very analytical. I've seen guys doing incredibly thorough investigations for much smaller amounts of money.

[Pmalek]

Which hardware wallet do you recommend , if any? Trezor looks to work in a poor RNG

What do you mean by Trezor working in a poor RNG?

I know from previous posts that Meuserna is a fan of hardware signers like Krux. Recently he has also been talking about the Seedsigner and its fork, the Shieldsigner. I think he uses encrypted seedQRs and multiple BIP85 child seeds generated offline that he exports and uses in other wallets.

A passphrase would be not enough if you are using a bad instruments like a coldcard. the fault was on hardware itself a password would just add a layer but the hacker already knows....

A long and complex passphrase is still non-hackable with today's technology. If a Coldcard-generated seed was additionally protected with a complex passphrase, the BTC would probably not be among the +1500 coins that got stolen. Some 2 and 3-word passphrases got bruteforced. An 8-word passphrase wouldn't be. An 8-word passphrase with numbers, lowercase & uppercase letters, and special characters even less so.

[Wind_FURY]

The "hacker" should have used ThorChain, and swapped the stolen Bitcoin to Monero starting in Day Zero and continued that when more Bitcoin is stolen.

But the hacker's current move is good to test how those mixers are good in obfuscation. For that purpose, they should probably test CoinJoin too.

For that to happen, he needed to have planned for the possibility of acquiring that large amount of Bitcoin.

He probably didn't expect to be so successful, and the fact that he was discovered just a few hours later didn't even give him time to think of a solution.

That's a lot of money; he's going to have to use many, many tools to "launder" all that cash, especially now that there are a thousand eyes on him.

The majority of centralized mixers are probably going to block him, some CoinJoin coordinators will probably not want any problems/issues too, and ThorChain does have network capability for localized censorship?

This is a very good example of Bitcoin's transparency as a feature, not a bug.

 

[LoyceV]

Just reading this on reddit. It seems the hacker is trying to move the money but still not smart enough to do that.

The "hacker" should have used ThorChain, and swapped the stolen Bitcoin to Monero

The hacker can read advice on what to do from all those people who call him "not smart enough"
From the Reddit screenshot: 64 BTC in, 54 BTC traced out. That means 10 BTC is now hidden (and people who had nothing to do with this hack now own 10 BTC from this hack).

I imagine the hacker sweating all over every time they wake up, still trying to find out the best way to do this.

But at this significant value, there is no thing they can do.  They would have to change their life significantly to be able to enjoy even some of that stolen money.  100,000 Dollars would have been a lot easier to manage.

There's nothing stopping him from just enjoying $100,000 instead of the full $100 million. $100k still buys a lot of blackjack and hookers
Next, he'll buy a car wash in Albuquerque and lets his wife work there to launder the money.

I know what I would have done if I was this evil.

Me too. We'd be criminal masterminds if we'd be evil.

(image source)

And I firmly believe Ledger's key extraction scheme is a disaster waiting to happen.

For now, the extraction must be physically authorized in the device.

Is that a hardware limitation, or is it just the firmware telling you you need to authorize it? I'm pretty sure a cracked firmware wouldn't need your consent, and thousands of hackers can peacefully try to hack the device from their own home.

Trezor looks to work in a poor RNG

What makes you say that?

[examplens]

He could have stealing 5-10 bitcoin per month for a few months, nobody would have noticed and blamed coldcard.

It could be done, but that would require planning. Something that, in my view, seems not to have existed.

In his defence, wouldn't he run the risk of someone else recognising this flaw at Coldcard in the meantime and emptying all the wallets?
In fact, how do we know that someone hasn't done it for months, but only now did this one appear who took everything.

[fillippone]

And I firmly believe Ledger's key extraction scheme is a disaster waiting to happen. It'll go down the same way, except in Ledger's case, it'll be the devices themselves that get accessed. And when it happens, finally, people will realize it's stooooopid to think you can safely secure Bitcoin on a hardware wallet that can be accessed over the internet.

For now, the extraction must be physically authorized in the device. People who authorized are at risk, not sure about the others.

Which hardware wallet do you recommend , if any? Trezor looks to work in a poor RNG

I would recommend at least two steps: using an hardware wallet that hasn’t been using subpar practice, this mean avoid ledger, at least, and using one that supports your own entropy to generate the seed, via dice rolling, for example.
This, before moving to a multivendor, multi sign setup.

[bitbollo]

...
A long and complex passphrase is still non-hackable with today's technology. If a Coldcard-generated seed was additionally protected with a complex passphrase, the BTC would probably not be among the +1500 coins that got stolen. Some 2 and 3-word passphrases got bruteforced. An 8-word passphrase wouldn't be. An 8-word passphrase with numbers, lowercase & uppercase letters, and special characters even less so.

These are two different things and in one case your bitcoin are at risk (like here with coldcard scam...) :
-passphrase or password (bip38) would not help you at all.

A custom password used to encrypt and lock a single Bitcoin private key into a secure 58-character string

-extra-word or bip39 (that is not a password but literally part of the seed) yes it's an extra word and not the password it would be used.
Yes a very long string could help but at this point I don't see any reason to have those risks and rely on a third party for a seed generation.

[fillippone]

Yes a very long string could help but at this point I don't see any reason to have those risks and rely on a third party for a seed generation.

Something I have been thinking lately is the amount of trust we carelessly put in external software when building custody strategies for our stashes.
The most simple setup is often the best solution: roll your dice, use your airgapped device to generate the last word and be it.
Yes, multi signature is a very nice feature, but will you able to recover the various mishaps you could face using it?

[BlackHatCoiner]

Yes, multi signature is a very nice feature, but will you able to recover the various mishaps you could face using it?

The main problem with multi-sig is that you need to have all the master public keys. If your setup is 2-of-3, then losing an access to one means losing access to your entire stash. Backing up your setup means backing up multiple seed phrases, at which point it starts becoming a very complicated setup, which risks you forgetting something and getting locked out of your funds. I find this scary also.

[fillippone]

Yes, multi signature is a very nice feature, but will you able to recover the various mishaps you could face using it?

The main problem with multi-sig is that you need to have all the master public keys. If your setup is 2-of-3, then losing an access to one means losing access to your entire stash. Backing up your setup means backing up multiple seed phrases, at which point it starts becoming a very complicated setup, which risks you forgetting something and getting locked out of your funds. I find this scary also.

Not only the seeds, but the xpub and wallet descriptor/configuration, even if the latter can be maintained under a less secure protocol, as it doesn’t entail a loss of fund, but a loss of privacy only.
Then with such a delicate setup, the exact type of hardware device might have some sort of relevance in case of physical damages.
Definetly doable, but we are still early in the “user experiences” of such a setup.

[bitmover]

And I firmly believe Ledger's key extraction scheme is a disaster waiting to happen.

For now, the extraction must be physically authorized in the device.

Is that a hardware limitation, or is it just the firmware telling you you need to authorize it? I'm pretty sure a cracked firmware wouldn't need your consent, and thousands of hackers can peacefully try to hack the device from their own home.

This is how it was designed. Without your PIN, the seed doesn't leave the device.

Plus, your Ledger will only allow your seed phrase to leave the wallet as encrypted fragments when you permit it. Setting up Ledger Recover requires you to enter the device PIN and consent to start the process on the device. Without your permission, the device will not (and cannot) fragment or send the encrypted fragments anywhere. That means if someone wants to exploit Ledger Recover to steal your seed phrase, they would need to have your PIN in the first place, which would already give them access to your wallet.
https://www.ledger.com/academy/what-is-ledger-recover

I am not using it, and i think it is a terrible feature.
But I see too much misinformation about this.

Trezor looks to work in a poor RNG

What makes you say that?

This. But I agree that it looks to have "enough" entropy, specially with a strong passphrase. But not as good as ledged for example.

I have seen discussion about this in other places, but couldn't find now.

[fillippone]

This. But I agree that it looks to have "enough" entropy, specially with a strong passphrase. But not as good as ledged for example.

I have seen discussion about this in other places, but couldn't find now.

If you had looked at this picture a quarter of an hour before the Coldcard exploit, it would have looked extremely different (if I am able to make myself understood).
What I mean is: again, you are trusting someone whose entropy is good. Why are you putting this trust in a scheme that has already failed once, instead of removing it in the first place?

[bitmover]

What I mean is: again, you are trusting someone whose entropy is good. Why are you putting this trust in a scheme that has already failed once, instead of removing it in the first place?

Something I have been thinking lately is the amount of trust we carelessly put in external software when building custody strategies for our stashes.
The most simple setup is often the best solution: roll your dice, use your airgapped device to generate the last word and be it.

Maybe removing the network card of a notebook, and use it to generate the QR code of signed transactions, is the best option.

But this looks so much trouble to something that should be much simpler.

[LoyceV]

This is how it was designed. Without your PIN, the seed doesn't leave the device.

I'm not buying it. The initial story was that your seed can't leave the device at all. Now it needs your PIN. What's stopping the firmware from not asking the PIN at all?

I am not using it, and i think it is a terrible feature.
But I see too much misinformation about this.

You're quoting Ledger, the company that lied that seed phrases could not leave the device. They're in the trust business, lying once means I'll never trust a word they say again.

Trezor looks to work in a poor RNG

What makes you say that?

This. ~

That image doesn't show anything about Trezor's Random Number Generator. It's well known that 12 seed words provide less entropy than 24 words, and that it's sufficient anyway. But you're free to stick to 24 words (that's what I did).

I've seen that picture before, they use "10²² years" and "many times longer than the age of the universe". That's weird, because "10²² years" is already 700 billion times longer than the age of the universe.

[Lucius]

This is how it was designed. Without your PIN, the seed doesn't leave the device.

I'm not buying it. The initial story was that your seed can't leave the device at all. Now it needs your PIN. What's stopping the firmware from not asking the PIN at all?

I am not using it, and i think it is a terrible feature.
But I see too much misinformation about this.

You're quoting Ledger, the company that lied that seed phrases could not leave the device. They're in the trust business, lying once means I'll never trust a word they say again.
~snip~

He's probably the only member of this forum who still thinks everyone else is spreading conspiracy theories when it comes to Ledger - the very fact that the seed can be remotely extracted from that device should have been a warning sign the moment the news was confirmed.

It's not a question of whether this "feature" will be abused one day, it's just a question of when it will happen. Given that this company still produces and sells devices, I would conclude that a very large number of those who use hardware wallets have no idea what risks they are exposed to.

[Pmalek]

-extra-word or bip39 (that is not a password but literally part of the seed) yes it's an extra word and not the password it would be used.
Yes a very long string could help but at this point I don't see any reason to have those risks and rely on a third party for a seed generation.

My point was that passphrases do work as an additional security layer. How well they work depends on their length and complexity. I am in no way advocating for people to stay with Coldcard and keep using them. I think and hope that the company is done and that we won't see them come back from this. I am advocating for using complex passphrases as seed extensions, though. A good passphrase could have saved some of those people who lost their coins, giving them some time to find and set up a different storage for their coins when the hacking began.

This. But I agree that it looks to have "enough" entropy, specially with a strong passphrase. But not as good as ledged for example.

A 12-word seed generates 128 bits of entropy. A 24-word seed generates 256 bits. 128 bits of entropy is enough. If you make your Trezor generate a 24-word seed, just like Ledger does, you would get the same 256 bits.

[LoyceV]

I am advocating for using complex passphrases as seed extensions, though.

How does that work? Say you have a Trezor: do you enter that complex seed extension each time you use the device, using those 2 small keys scrolling through characters?

[Pmalek]

How does that work? Say you have a Trezor: do you enter that complex seed extension each time you use the device, using those 2 small keys scrolling through characters?

Something like that. It's inconvenient, I know, but so is self-custody. As you know, every increase in security decreases convenience and ease of use. With Trezor Model One, you don't enter passphrases on the device. You do it on the computer the hardware wallet is connected to. It's far from the best approach but it's ok if you are careful and use a dedicated computer just for bitcoin, for example. A Jade is also pretty nightmarish for passphrase entries. It uses a wheel as navigation that you flick left or right. Inconvenient and time-consuming but an increase in security. 

[BlackHatCoiner]

You do it on the computer the hardware wallet is connected to. It's far from the best approach but it's ok if you are careful and use a dedicated computer just for bitcoin, for example.

This sounds like having a dedicated airgapped computer for bitcoin with extra steps.

Am I the only one who just does not trust neither Trezor nor Ledger? The whole point of using separate hardware is so that you do not put any trust on neither the computer nor the coordinator wallet software running (such as Sparrow), but I feel like there are far more attack vectors that can be exploited to a hardware wallet that connects with the computer, than a signing device that is airgapped.

[Danish Ali]

You do it on the computer the hardware wallet is connected to. It's far from the best approach but it's ok if you are careful and use a dedicated computer just for bitcoin, for example.

This sounds like having a dedicated airgapped computer for bitcoin with extra steps.

Am I the only one who just does not trust neither Trezor nor Ledger? The whole point of using separate hardware is so that you do not put any trust on neither the computer nor the coordinator wallet software running (such as Sparrow), but I feel like there are far more attack vectors that can be exploited to a hardware wallet that connects with the computer, than a signing device that is airgapped.

Spot on. The whole security model of a hardware wallet falls apart the second it shares a physical data interface with an internet connected host.

Stateless, opensource airgapped signers with optical QR communication are the only true way to eliminate host machine trust.