The Coldcard exploit announcement needs to be pinned or created

[NotATether]

In the past few hours, there has been a large-scale theft of hundreds of users' funds which were being held in Coldcard hardware wallets, especially Mk2 and Mk3.

It seems like this is a firmware vulnerability and not any user error on their part.

I think Bitcointalk needs to create another Important Announcement for the Coldcard users to transfer their funds elsewhere immediately before more people get robbed.

Maybe a pin would also work, but I'm strongly leaning towards the former idea

[Upgrade00]

It can be highlighted in the news section above where bitcoin core releases are updated and maybe with a warning colour to bring attention to it. Most people are already used to what is displayed there that they may instinctively not read it, but if it's in a light red colour they would. Would disturb the aesthetics a little, but if it saves one person would be worth it.
 

[NotATether]

It can be highlighted in the news section above where bitcoin core releases are updated and maybe with a warning colour to bring attention to it. Most people are already used to what is displayed there that they may instinctively not read it, but if it's in a light red colour they would. Would disturb the aesthetics a little, but if it saves one person would be worth it.

Sounds good. I'm sure many people would rather have slightly irritated eyes than lose 1BTC+ to hackers.

[Hypnotizer]

Sounds good. I'm sure many people would rather have slightly irritated eyes than lose 1BTC+ to hackers.

Well it has been done by the moderators ✔️

Just saw the news this morning and I’m getting to know more about the exploit but it’s honestly very sad. My big condolences to the users that have loss their funds from this.

[theymos]

Good idea, thanks. A lot of users have email notifications enabled for the Important Announcements board, so that's a good way to reach people about a device released ~7 years ago.

[TokenTikas]

Thank you, NotATether, for making an announcement of such important news here immediately. Administrator theymos noticed your post very recently and added it to the top of the forum homepage. I suddenly came to know about the Coldcard exploit after seeing the news headline at the top.

Because it has been made a headline at the top of the forum homepage, users will see it as soon as they come to the forum and will be able to be informed about this matter. Even if the users have made no mistake, it still feels disappointing when we see this kind of activity where bitcoin is lost, because the users lose the money they earned through their hard work.

[NotATether]

Good idea, thanks. A lot of users have email notifications enabled for the Important Announcements board, so that's a good way to reach people about a device released ~7 years ago.

Thank you theymos

One small correction

It seems that Mk2 wallets have the same vulnerability as Mk3 as well

Here's the full list of vulnerable devices and their firmware versions.



Note that there is a firmware patch for Mk4, Q, and Mk5. For Mk3 and Mk2, there is no patch, so they must transfer funds out to a more secure seed phrase.

[dkbit98]

In the past few hours, there has been a large-scale theft of hundreds of users' funds which were being held in Coldcard hardware wallets, especially Mk2 and Mk3.

All c0ldcard devices, and even newer models generated weak entropy.
Number of affected devices and lost coins are growing every days, so I woulod move coins asap, and stop using this crap.

[AakZaki]

In the past few hours, there has been a large-scale theft of hundreds of users' funds which were being held in Coldcard hardware wallets, especially Mk2 and Mk3.

All c0ldcard devices, and even newer models generated weak entropy.
Number of affected devices and lost coins are growing every days, so I woulod move coins asap, and stop using this crap.

I think you mean something like this, right?


Firmware updates here https://coldcard.com/docs/upgrade/ seem very complicated with a long explanation, but after I saw in the YT video for how to upgrade the Firmware is also inefficient, because it requires uninstalling the SD Card for the process of downloading and storing the Firmware.

Trezor users laughed at seeing such a way. Lol

[taufik123]

I think you mean something like this, right?


Firmware updates here https://coldcard.com/docs/upgrade/ seem very complicated with a long explanation, but after I saw in the YT video for how to upgrade the Firmware is also inefficient, because it requires uninstalling the SD Card for the process of downloading and storing the Firmware.

Trezor users laughed at seeing such a way. Lol

LOL, I laughed seeing it, A proper solution to just throw it away.
Even the latest firmware has problems and instead of fixing the bugs that occurred, Coinkite offered Coldcard Mk5 instead
It's like offering newer Booby trap to users.
Will you accept their good offer?

Video: https://x.com/northernH0DL/status/2083305136047149495


Source: https://x.com/HodlDee/status/2083338124072034364

[m2017]

LOL, I laughed seeing it, A proper solution to just throw it away.
Even the latest firmware has problems and instead of fixing the bugs that occurred, Coinkite offered Coldcard Mk5 instead
It's like offering newer Booby trap to users.
Will you accept their good offer?


Source: https://x.com/HodlDee/status/2083338124072034364

Of course, this is only if the balance of this MK5 device contains exactly the same number of bitcoins as in the previous version of Coldcard (before the hack).

HW devices manufacturers have protected themselves by claiming they are not responsible for the security of the wallet's contents. This is certainly true in cases where the user is responsible for the loss of the seed phrase (and bitcoins stored on the wallet). But in the case of Coldcard, the blame lies entirely with the manufacturer, as the vulnerability arose due to a technical issue that this company failed to fix in a timely manner. The question is: can Coldcard be held legally liable?