Large-scale Coldcard compromise (1596 BTC stolen so far)

[LoyceV]

Stateless, opensource airgapped signers with optical QR communication are the only true way to eliminate host machine trust.

I've never used those, but I've always been curious: how do you know for sure the QR isn't compromised? I'd wouldn't feel completely safe without decoding the QR on another air-gapped system.

[BlackHatCoiner]

I've never used those, but I've always been curious: how do you know for sure the QR isn't compromised? I'd wouldn't feel completely safe without decoding the QR on another air-gapped system.

The signing device displays on its little screen what inputs you spend and what outputs you create (which addresses are being paid), therefore you don't trust the coordinator software for sending a compromised QR image. 

Unless you're asking how do you know that the compromised QR image doesn't exploit a vulnerability that would allow the attacker to compromise your funds. For example, a compromised QR image could be a series of bytes that disable something in the firmware, but this is another level of paranoia for the sake of the discussion. What matters is that it can't steal your randomly generated seed phrase.

[Meuserna]

And I firmly believe Ledger's key extraction scheme is a disaster waiting to happen. It'll go down the same way, except in Ledger's case, it'll be the devices themselves that get accessed. And when it happens, finally, people will realize it's stooooopid to think you can safely secure Bitcoin on a hardware wallet that can be accessed over the internet.

For now, the extraction must be physically authorized in the device. People who authorized are at risk, not sure about the others.

Prove it.

You can't, because the firmware isn't open source. I'm sure somebody wants to say, "Well, some of it is." And some of this meal isn't poison. Want a bite?

I do not understand why people trust closed source firmware.

Which hardware wallet do you recommend , if any? Trezor looks to work in a poor RNG

I don't know where you're getting that from. Trezor's entropy looks to be strong - however - why let a device generate a seed for you in the first place? I've been generating my own seed phrases for years. I know the randomness of my seeds is truly random because I did it myself.

There are many ways to generate your own random seed. Dice is one, but I prefer the "Entropia" method. BTC Hardware Solutions sells what they call "Entropia" tablets, which are plastic seed words. Dump 'em in a mixing bowl, stir it up and pick a word. Write it down. Put the word back in the bowl, stir again and pick again. Do this 23 times and use those words as your seed, letting a hardware wallet generate the 24th word (the checksum).

Don't want to spend the money on buying Entropia? No problem. Print the seed words on paper and chop 'em up. The best way to do this is list the words in columns. You should easily be able to get all of the words in 4 or 5 sheets of paper. Chop 'em up so each word is on a slip of paper. Dump 'em in a bowl. And by the way... any inconsistencies in how you chop them up will add more randomness.

[Meuserna]

And I firmly believe Ledger's key extraction scheme is a disaster waiting to happen.

For now, the extraction must be physically authorized in the device.

Is that a hardware limitation, or is it just the firmware telling you you need to authorize it? I'm pretty sure a cracked firmware wouldn't need your consent, and thousands of hackers can peacefully try to hack the device from their own home.

This is how it was designed. Without your PIN, the seed doesn't leave the device.

Plus, your Ledger will only allow your seed phrase to leave the wallet as encrypted fragments when you permit it. Setting up Ledger Recover requires you to enter the device PIN and consent to start the process on the device. Without your permission, the device will not (and cannot) fragment or send the encrypted fragments anywhere. That means if someone wants to exploit Ledger Recover to steal your seed phrase, they would need to have your PIN in the first place, which would already give them access to your wallet.
https://www.ledger.com/academy/what-is-ledger-recover

Surely you realize quoting Ledger about their closed source code is the same as quoting Coinkite about ColdCard's closed source code. In May, they said it was the best. How'd that work out?

I do not understand why people trust code that isn't open source. It makes no sense.

In theory, you know how Ledger's code is supposed to function, according to Ledger. But hackers aren't going to use the code as intended. They're going to find exploits. And since Ledger devices have the ability to export the seed out of the device over the internet (which for years they swore wasn't even possible!), their code is one heck of a honeypot just waiting to be hacked.

And I do not understand why people trust companies after they lied. Ledger said this:

"Private data, such as your private keys will be protected and never leave the device due to the combination of BOLOS and the Secure Element."

That was a lie. It's one of many lies they had to scrub from their website because their firmware contains an API to extract keys from their devices over the internet, which for years they swore was not possible.

Here's a lie that cracks me up.

"WE ARE OPEN SOURCE"

That's printed on the box of a closed-source Ledger hardware wallet:
https://i.redd.it/dysdk6j9516b1.jpg

And here's a great quote from BTChip, Ledger owner & co-founder

There's no backdoor and I obviously can't prove it

He obviously can't prove it, because his code isn't open.

Trusting Ledger's word today is like Trusting Coinkite's word in May.

[bitmover]

There are many ways to generate your own random seed. Dice is one, but I prefer the "Entropia" method. BTC Hardware Solutions sells what they call "Entropia" tablets, which are plastic seed words. Dump 'em in a mixing bowl, stir it up and pick a word. Write it down. Put the word back in the bowl, stir again and pick again. Do this 23 times and use those words as your seed, letting a hardware wallet generate the 24th word (the checksum).

Don't want to spend the money on buying Entropia? No problem. Print the seed words on paper and chop 'em up. The best way to do this is list the words in columns. You should easily be able to get all of the words in 4 or 5 sheets of paper. Chop 'em up so each word is on a slip of paper. Dump 'em in a bowl. And by the way... any inconsistencies in how you chop them up will add more randomness.

I dont think generating your own seed is a problem.
But what do you do with it after you generated it? Do you add your seed to a hw?
Do you add to a electrum in an offline device and generate qr codes of signed transactions  to scan in other devices

This is where things get complicated,  and may become insecure specially in long term

[Danish Ali]

I've never used those, but I've always been curious: how do you know for sure the QR isn't compromised? I'd wouldn't feel completely safe without decoding the QR on another air-gapped system.

The signing device displays on its little screen what inputs you spend and what outputs you create (which addresses are being paid), therefore you don't trust the coordinator software for sending a compromised QR image. 

Unless you're asking how do you know that the compromised QR image doesn't exploit a vulnerability that would allow the attacker to compromise your funds. For example, a compromised QR image could be a series of bytes that disable something in the firmware, but this is another level of paranoia for the sake of the discussion. What matters is that it can't steal your randomly generated seed phrase.

BlackHatCoiner explained the visual verification logic perfectly.

Beyond that, stateless signers also rely on open-source reproducible builds and standardized PSBT specs (BC-UR v2) to ensure the QR data payload isn't modified or leaking key material.

I did a detailed breakdown on their security models here:

https://bitcointalk.org/index.php?topic=5591374.msg67049627#msg67049627

[Meuserna]

There are many ways to generate your own random seed. Dice is one, but I prefer the "Entropia" method. BTC Hardware Solutions sells what they call "Entropia" tablets, which are plastic seed words. Dump 'em in a mixing bowl, stir it up and pick a word. Write it down. Put the word back in the bowl, stir again and pick again. Do this 23 times and use those words as your seed, letting a hardware wallet generate the 24th word (the checksum).

Don't want to spend the money on buying Entropia? No problem. Print the seed words on paper and chop 'em up. The best way to do this is list the words in columns. You should easily be able to get all of the words in 4 or 5 sheets of paper. Chop 'em up so each word is on a slip of paper. Dump 'em in a bowl. And by the way... any inconsistencies in how you chop them up will add more randomness.

I dont think generating your own seed is a problem.
But what do you do with it after you generated it? Do you add your seed to a hw?
Do you add to a electrum in an offline device and generate qr codes of signed transactions  to scan in other devices

This is where things get complicated,  and may become insecure specially in long term

I enter my seed phrase into a hardware wallet that is:

100% open source.
Airgapped.
Stateless.

Airgapped means the device never connects to the internet, or to anything at all. The device communicates using a camera and a screen. Hackers can't reach it over the internet.

Stateless means my seed is never saved on the device. When the device turns off, the seed and the wallet are wiped. If the device gets lost or stolen, no worries. There's nothing on it.

I never save my seed on any device, ever.

To use an airgapped and stateless device, you need a coordinator app, just as you use with any hardware wallet. I'm a fan of Sparrow for desktop, and Blue Wallet for mobile. Nunchuk is great too, for managing xpubs, but it's not as user friendly.

[joker_josue]

Stateless, opensource airgapped signers with optical QR communication are the only true way to eliminate host machine trust.

I've never used those, but I've always been curious: how do you know for sure the QR isn't compromised? I'd wouldn't feel completely safe without decoding the QR on another air-gapped system.

With Seedsigner, you manually copy the QR code yourself. Therefore, it's up to you to ensure it's correct.
Then, to validate, you can use an old mobile phone, without an internet connection, to read the QR Code and check if it matches what was supposed to.

I haven't tested this system yet, but I've read good feedback about it.

Airgapped means the device never connects to the internet, or to anything at all. The device communicates using a camera and a screen. Hackers can't reach it over the internet.

Stateless means my seed is never saved on the device. When the device turns off, the seed and the wallet are wiped. If the device gets lost or stolen, no worries. There's nothing on it.

I never save my seed on any device, ever.

The issue is saving the QR code to validate transactions.
The person must take care to keep it well stored. It's also not the solution for crates that are used more frequently.

[Meuserna]

Airgapped means the device never connects to the internet, or to anything at all. The device communicates using a camera and a screen. Hackers can't reach it over the internet.

Stateless means my seed is never saved on the device. When the device turns off, the seed and the wallet are wiped. If the device gets lost or stolen, no worries. There's nothing on it.

I never save my seed on any device, ever.

The issue is saving the QR code to validate transactions.
The person must take care to keep it well stored. It's also not the solution for crates that are used more frequently.

Krux, Kern and ShieldSigner include the option to use encrypted seed QRs, which is how I do it. With an encrypted seed QR, even if somebody finds your QR, they can't scan it unless they have the decryption key.

ShieldSigner is a SeedSigner fork that runs on the same hardware as SeedSigner but adds tons of features including encrypted seed QR and passphrase QR. ShieldSigner also adds smartcard capability (SeedKeeper and SatoChip).

I'm a big fan of using two different hardware wallets (Krux and ShieldSigner), because each can confirm the other is doing exactly what it says it's doing. I don't use 2 for every transaction, but I do use 2 when setting up a new wallet, just to confirm everything is exactly right. I'm sure somebody will read that and think it's overkill, but that seems bizarre to me. For anyone who is serious about Bitcoin, isn't it worth a few extra seconds to double-check something? I think it is.

[shahzadafzal]

Has anyone else noticed something interesting about @DocumentingBTC on X lately? 👀

Recently they've been posting Bitcoin history straight from Bitcointalk — old Satoshi posts, screenshots and pieces of forum history.

And don't get me wrong, I absolutely love it. This is exactly the kind of Bitcoin history worth documenting.

But... it also makes me suspicious. 😏

Has @DocumentingBTC been taken over by someone who's actually active on Bitcointalk?

Or perhaps there's an old Bitcointalk OG sitting behind that account, quietly digging through the archives and thinking:

"These youngsters on X need to learn some history." 😂

Whoever is behind it certainly seems to know where the good stuff is buried.



https://x.com/documentingbtc/status/2093335575109546410?s=46&t=EYlgQnpcCaCtcz2k1Mwk

Come on... which one of you WO OG is running @DocumentingBTC? 👀₿

[PrivacyG]

This is all pure speculation.  There is nothing to back up the idea that an attacker of this level is sitting around sweating, or taking advice from ChatGPT.  On what basis do you make such assumptions?

This is how I started my reply,

I imagine

And for the other part of your question,

If Artificial Intelligence helped them find the bug, by the way it looks it is also Chat GPT telling them

Or.  To put more focus on the part that probably matters the most,

by the way it looks

You make me curious.  What kind of proof can I provide for my imagination?

[Stalker22]

You make me curious.  What kind of proof can I provide for my imagination?

You are right.  I was a bit hasty and obviously did not fully understand your post.  Sorry about that. 

I imagine it happens to the best of us when we are sifting through tons of garbage posts on here every single day.

[Dark.Look]

This is where things get complicated,  and may become insecure specially in long term

The problem is it's not the signing setup but it's the fact that you never agreed to the device.

Whatever you build. build a second independent implementation of anything that comes from those same words to get the xpub from.Before funding anything get the xpub from those same words on a second indepndent implementation of anything you build. Same words and same xpub. I think both sparrow and electrum will do it from seed without the internet access. If both are the same then the device has not silently replaced or corrupted the text you entered. Otherwis you know that at the time the wallet was empty.

The whole thing this mess argues for is that one cannot estimate entropy from the output and vice versa a device to which one gave good entropy. The only element in the chain that can be verified is cross derivation.

[tvbcof]

I've been putting some thought into the air-gap stuff over the last week.  I'm more and more a fan of stateless systems.  I'm also inspired by this guy's work: https://bitcointalk.org/index.php?topic=5591806.0

I'm considering an open project with the following 'features':

 - Extreme simplicity.  Utilization of the most simple MCU's possible with an eye toward 'generic' function so that suppliers could be plentiful and the hardware cheap.

 - Straight C buildable on small and simple compilers (TCC, SmallerC, etc.)

 - A _family_ of air-gapped products with it's niche, and a very basic communications protocol between them (e.g., transfer of a checksum'd data block typically utilizing QR or similar.)  Data transfer via TF card allowed.  Most other communications and storage means simply not present on the hardware.

   -  An air-gapped 'signing' device only used for very simple operations (but usable alone with QR code boots.)
   -  An air-gapped 'utility' device for manipulations of data, wallet generation, helping draw QR's by hand, compiling firmware, etc.
   -  An air-gapped 'printer' device for those who need it.

The idea is, of course, to never need to let seed material outside of the 'family' to phones, workstations, etc, but still be able to do more complex or automated things if needed.  By having multiple devices, the idea is to keep the most critical (the signing device) be as stone simple and auditable as possible.  In being neutral about compilers and workable on very simple ones, it is hoped to avoid the need for firmware construction to be from a particular tool kit.  Especially a bloated, powerful, and commonly used/attacked one.  Being realistically auditable across the board is of utmost priority.

I'll just throw this out there here, and if fruitful discussions follow we can make a new thread.

[suzanne5223]

The "hacker" should have used ThorChain, and swapped the stolen Bitcoin to Monero starting in Day Zero and continued that when more Bitcoin is stolen.

But the hacker's current move is good to test how those mixers are good in obfuscation. For that purpose, they should probably test CoinJoin too.

Thorchain website isn't working right now, and no monero support


I am not sure how you can access it without the front end , but it should be possible. Actually, using the front end would be quite dangerous for him because it could save logs.

Please don't let us discuss information that could help the hacker successfully mix the stolen Bitcoin due to this forum's powerful backlinks, because the hacker is technically looking for ways to do it, which is why the 65BTC was used as a test. Besides, the hackers are still stealing from people who are still using the vulnerable coldcard wallet.
https://x.com/intangiblecoins/status/2093457952103387618
https://cktripwire.com/

[Pmalek]

Surely you realize quoting Ledger about their closed source code is the same as quoting Coinkite about ColdCard's closed source code. In May, they said it was the best. How'd that work out?

Small correction. Coldcard's codebase isn't closed-source. It isn't open-source either. Perhaps you are using the logic if it isn't open-source then it must be close-source but that would be wrong. Coldcard is source-verifiable. In other words, you, me, and everyone else had five years to find the faulty code in the publicly available repository. No one did. One day someone with AI did.

One can argue the point that if there was no public code for AI to inspect, the vulnerability (that still existed whether the code was public or not) wouldn't have been found neither in Coldcard nor in several other open-source projects that were affected and attacked in recent weeks.

Open-source projects are in equal danger as source-verifiable ones if there are vulnerabilities in their code that can be exploited. And they have been. Some have lost money, some have shut down, others have released critical updates, etc. It's always good vs evil. The more eyes investigate and research something, the better it is (generally). At the same time the more dangerous it is, depending on the motivations of those who are looking.

[Lucius]

This sounds like having a dedicated airgapped computer for bitcoin with extra steps.

Am I the only one who just does not trust neither Trezor nor Ledger? The whole point of using separate hardware is so that you do not put any trust on neither the computer nor the coordinator wallet software running (such as Sparrow), but I feel like there are far more attack vectors that can be exploited to a hardware wallet that connects with the computer, than a signing device that is airgapped.

Not a single hardware wallet that you have to connect to an online computer to function is on my list of devices I trust, although I have a Trezor that I use for amounts I can afford to lose. The only thing I still have some confidence in are air-gapped wallets, but even there things are clearly not completely secure considering what happened.

I am advocating for using complex passphrases as seed extensions, though.

How does that work? Say you have a Trezor: do you enter that complex seed extension each time you use the device, using those 2 small keys scrolling through characters?

You buy hardware wallet that has a physical keyboard and if you still remember how we used to write SMS messages on the good old Nokia 3310, you won't have any problems entering a 15-20 character passphrase.