Targetnya Coldcard lawas dan setelah itu hanya butuh sekitar 20 menitan untuk memindahkan sekitar 594 bitcoin dari ratusan wallet terpisah ke single address baru.
ColdCard lama terutama Coldcard Mk3 yang jadi sangat rentan meskipun sebenarnya udah di update firmwarenya, 594 BTC itu hanya sebagian saja dan masih ada lebih banyak lagi.
Untuk Coldcard Mk4+ juga masih cukup rentan.
Mk4, Q, and Mk5 seem to be OK according to this tweet
This disagrees with my analysis. I believe the attack is ~32-bits harder on Mk4+ but they're still vulnerable.
Is there an actual or exact failure in what has happened? To correctly do something about it, there should be something definitive to understand the root cause of it.
The coldcard source code attempts to disable the hardware RNG support in micropython because they provide their own implementation, but the handling of the the disable flag is inconsistent.
To disable it they #define MICROPY_HW_ENABLE_RNG (0) and this successfully disables it.
But to enable their replacement they check #ifndef MICROPY_HW_ENABLE_RNG --- and this is ineffective because the if(n)def directive checks only if the flag MICROPY_HW_ENABLE_RNG is defined, its value "(0)" is irrelevant and counts as defined just as any other value would. Probably any sufficiently long-expirenced C programmer has encountered a form of this #if vs #ifdef confusion.
This inconsistency makes the coldcard firmware not use its own HWRNG support code but instead call the micropython random function. But the micropython function has its hardware support disabled and when it is disabled it replaces it with a placebo insecure PRNG function which is seeded with part of the devices hardware id and a timer. "Micropython: We've replaced this users randomness with Folgers Crystals, lets see if they notice".
The replacement function *looks* like good random numbers... but they're not random at all, and provide essentially no security. However, if you were to try to judge their quality with tools like diehard you would probably get a result that they were high quality -- this the reason RNGs are such a risky part: the quality of a random stream depends on how it was created and can't be detected purely from the random values itself.
So for mk3 the attacker just needs to search the likely hwids and timer values for wallets.
For mk4+ the not-random random value from above gets xored with another instance of the same placebo function (more Folgers Crystals), initialized with a 32-bit presumably secure random value that ultimately comes from another chip inside the wallet. The 32-bits of extra security is not enough to make it secure, but it may delay attacks by speak-and-spell wielding toddlers.
The use of "fallback" and no-security providing PRNG "whiteners" is a practice that some people have previously identified as risky due to the risk of accidentally hiding more serious bugs. Unfortunately both the authors of micropython and coldcard itself engaged in this particular sin, and fixing either one alone wouldn't have made the error immediately obvious. I wouldn't say that belt-and-suspenders like these are unconditionally bad, but incredible care must be taken to be sure that they aren't covering up other issues.
Take my analysis with a grain of salt: it's purely a product of personally reading the source code. I do understand that expert AI users also independently reached the same conclusion including with validation against a disassembled firmware image, which is why I feel confident enough sharing it.
Edit: This post is also consistent with the new coldcard blogpost:
https://blog.coinkite.com/entropy-technical-backgrounder/
Tapi khusus untuk coldcard, bagi kalian yang pakai saat ini (walau masih aman karena pakai passphrase) baiknya segera dipindahkan dengan segera, karena siapa tahu ke depan, awalnya 500 BTC, lalu sekarang sudah 1000 BTC lebih dicuri.
Sedikit menambahkan:
Sebelum menggunakan lebih jauh wallet dengan seed+passphrase, simulasikan untuk merecovery wallet agar jika terjadi hal yang mengharuskan demikian, semua seed+passphrase yang digunakan sudah dipastikan bisa berfungsi untuk mengembalikan wallet.
Btw, kalaupun masih tetap menggunakan ColdCard, jangan gunakan lagi seed phrase yang di-generate dari hardware tersebut, meiainkan import wallet dari seed phase yang digenerate dari wallet lain/non-Coldcard entropy.
Untuk Coldcard yang dijadikan Multisig wallet juga bisa terpengaruh jika masih menggunakan seed dari hasil generate di wallet tersebut.
- If you generated using dice or wordlist or another method that included non-Coldcard entropy, you are fine.
- If you generated on a non-Coldcard device, you are fine.
- If not, your funds are at risk. A passphrase will help slow it down but the main seed is still compromised.
Multisigs: You are affected *privacy wise* if one of your members is a Coldcard-generated seed. You are only at risk if the majority of your members are CC.
