COLDCARD VULNERABILITY : LESSONS TO LEARN

[EL MOHA]

I think most of us must have seen the news around Coldcard compromised, it was actually highlighted on the news section on the forum visible for everyone to see; coldcard compromised

I know many will be actually surprised because its primarily about hardware wallet which are considered safe but that is the reason why not all hardware are actually good for use.

This coldcard wallet was initially an open source wallet but right now it’s a source verifiable, what this means is that you can check the source code to verify it but cannot  legally use it on your project, what this means is that less developers will pay attention to it, because after all I can actually look into something that will be beneficial to me too. With few developers looking into it means less people finding the vulnerability or errors like randomness in creating seed phrases and this is clearly similar to closed sources too.

How was this attack pulled off

The attackers actually found a vulnerability in the RNG, that’s the randomness associated with the generation of seed phrase, we all know that the security of your wallet is basically on randomness and entropy which 128bits is just secure enough, so if your wallet software uses a weak PRNG generator it’s easier for attackers to actually find the vulnerability by getting a weak seed that is part or starts the generator and it’s around here that this coldcard vulnerability came from.

Extent of the attack so far

The attackers were sweeping addresses with at least 0.15 bitcoin base on the addresses posted running across 500 transactions, with total number of bitcoin stolen totaling over 1000 so far.

What should you do

1. First instance will be to not trust hardware wallets to actually generates your seeds for you most especially closed source or similar hardware wallets and the best thing is to generate your own seed phrases either manually by picking the words yourself and allowing a wallet to generate the last word for you only for checksum

2. ⁠or use open source wallets like electrum in an offline environment before Importing into your hardware wallet

3. ⁠use passphrase which are strong enough or make use of multi sig with most co-signers if not all generating seeds as described above.

This saves you from hardware wallet firmware attacks like this of coldcard
 4. Test this wallet first and back up all seed phrases and passphrase properly.

Who should be scared now

I will say if you’re using closed source wallet or even hardware wallets like ledger which extract yours seeds for you phrase for recovery then you should simply sweep your bitcoin to a new wallet

[Hypnotizer]

Extent of the attack so far

The attackers were sweeping addresses with at least 0.15 bitcoin base on the addresses posted running across 500 transactions, with total number of bitcoin stolen totaling over 1000 so far.

This was/is a very massive theft and many people have lost a lot of their hardwork to this theft just because of the decision of the Coldcard company and that emphasizes why you should not just trust any hardware wallet and think you’re safe because even hardware wallets have their own vulnerabilities and you should be due diligent when setting up a wallet to secure your investment.

Even though what has happened can’t be undone, this is really a good call for us all to learn from this and improve the security of our investment. Imagine DCAing/NCAing for a long period of time like four to five years, only for your efforts to be gone in seconds because of security vulnerabilities.

[Odohu]

Thank you for bringing this post to the local board, I have seen many places where this was posted but no one gave the detailed explanation you just made. Adding recommendation is also another good initiative from you for which I appreciate.

The rate of vulnerability these days is becoming scary and I wonder what we will be battling when quantum computers actually become a thing. Right now a lot of people who buy Bitcoin on a regular bases are even confused on what to do because of the increased security risk associated to wallets.

[Cryptoprincess101]

This is why it is advisable to use only trusted open source bitcoin wallets because I can't just imagine a hardware wallet being this vulnerable.

Anyways, this is a reminder for us to know that a bitcoin wallet is also important just the same way our seed phrases are important. We should beware of the hardware wallets we use.

Though, i read that the attack was done on the older version of the hardware wallet. This is also the reason why it is good to update to recent versions from time to time especially when a new version is available.

[Karl_3000]

1. First instance will be to not trust hardware wallets to actually generates your seeds for you most especially closed source or similar hardware wallets and the best thing is to generate your own seed phrases either manually by picking the words yourself and allowing a wallet to generate the last word for you only for checksum

Hardware wallets can be used to generate seed phrase. Know that what happened to Coldcard, something similar can happen on software wallet.

3. ⁠use passphrase which are strong enough or make use of multi sig with most co-signers if not all generating seeds as described above.

These are the correct solution that can prevent people against such attack.

This saves you from hardware wallet firmware attacks like this of coldcard
4. Test this wallet first and back up all seed phrases and passphrase properly.

This does not save you from the attack so far you are using the wallet. It can not let you know that your wallet use weak random number generator.

[Freeveto]

Who should be scared now

I will say if you’re using closed source wallet or even hardware wallets like ledger which extract yours seeds for you phrase for recovery then you should simply sweep your bitcoin to a new wallet

The main idea is diverting into a a compete open-source wallet that is commonly used and recognized by high crypto users, thinking about any closed-source wallet is very risky because according your explanation on this thread, the COLDCARD is not a completely an open-source wallet so it is vulnerable to attack by scammers just as this incident has happened.
I only take advices regarding bitcoin investment in this forum, maybe that’s why I don’t even know about this wallet, guys it’s a good lesson learned.

[Amphenomenon]

Who should be scared now

I will say if you’re using closed source wallet or even hardware wallets like ledger which extract yours seeds for you phrase for recovery then you should simply sweep your bitcoin to a new wallet

Another day to see why all of these including initiatives from Ledger can be harmful to customers,  anything closed source should not be relied on.

The thing about Cryptography many fails to see is that it strength is based on the majority that can verify and test it, you can't really create a Cryptography yourself or with a limited number of individuals and think it's secure oftentimes.

Now when big techs, companies, or businesses of a closed Cryptographic or security measures there will be more to judge this actions, it's quite unfortunate for the victims hopefully they get recompense one way or another.

[Tetu100]

I just see this one for the news feed this morning. I never really pay attention to the fact say we get news feed o lol, I surprise when I see am, I come they wonder if the news feed na something wey always dey there?

Not only you bro, I was also surprised seeing this News flash yesterday morning and I was trying to put some calls across to few forum users if they can be able to break in details what's all about.  But thank God for this, since it has practically convey the exact message that explains in details what the news is talking about to a lay man understanding Nice update, this is a welcome initiative.👌

[Doan9269]

I'm only happy that those who have not been affected yet but still use this hardware wallet will be quickly informed to take action against it, while those who are affected have no option but to accept their fate.

You should not play with information updates, and this is one of the reasons why I will always appreciate this platform for being a reliable source in this regard; anything that has to do with your asset security and privacy will duly be discussed here. You don't need to entrust anything to a third party; it is such a disappointing scenario seeing that a cold storage hardware wallet like a coldcard is being affected, but we shouldn't lose hope as well because this is all about the coldcard hardware wallet.

[IjawMan]

Thank you for bringing this post to the local board, I have seen many places where this was posted but no one gave the detailed explanation you just made. Adding recommendation is also another good initiative from you for which I appreciate.

The rate of vulnerability these days is becoming scary and I wonder what we will be battling when quantum computers actually become a thing. Right now a lot of people who buy Bitcoin on a regular bases are even confused on what to do because of the increased security risk associated to wallets.

The op has done a nice work by simplifying the whole circumstance surrounding the vulnerability cause that led to the theft of Bitcoins from Coldcard wallet users. The breakdown is easy to assimilate than any other post about this news I have read on the forum.

With the advancing of technology it lays a growing concern on digital assets security facing a possible  well-drilled sweep of wallet more than at any other time. May be instead of holding a chunk stack of Bitcoins in one wallet that attract hackers, the owner can split it into different wallets to make the quantity less attractive for hackers. Down side to this is that it gives extra responsibility burden and risk of storage of multiple keys.

[Moreno233]

This coldcard wallet was initially an open source wallet but right now it’s a source verifiable, what this means is that you can check the source code to verify it but cannot  legally use it on your project, what this means is that less developers will pay attention to it, because after all I can actually look into something that will be beneficial to me too. With few developers looking into it means less people finding the vulnerability or errors like randomness in creating seed phrases and this is clearly similar to closed sources too.

When a wallet moves from being open source to something else, are their users notified or they rely mainly on their news feeds only? I remembered that Trustwallet was open source before but later they moved from open source to close source and rherefore not ideal for storage. Assuming the users of this Coldcard are aware of their transition, I'm sure a lot of them would have moved their funds and possibly evade this loss.

[Hypnotizer]

When a wallet moves from being open source to something else, are their users notified or they rely mainly on their news feeds only? I remembered that Trustwallet was open source before but later they moved from open source to close source and rherefore not ideal for storage. Assuming the users of this Coldcard are aware of their transition, I'm sure a lot of them would have moved their funds and possibly evade this loss.

Even if their users knew about change from open source to closed source but verifiable ( which they probably do) they will still use it, it is a very trusted hardware wallet company (before this exploit), so still there wouldn’t be “lots of users” moving their funds and stopping to use their products. I think only wallet generated using the ColdCard firmware were affected by this theft because this vulnerability is directly linked to the RGN their firmware was using.

And mind you, the transition happened way back in 2021..

[Emjay24]

This saves you from hardware wallet firmware attacks like this of coldcard
4. Test this wallet first and back up all seed phrases and passphrase properly.

This does not save you from the attack so far you are using the wallet. It can not let you know that your wallet use weak random number generator.

It can save you because even though you have a weakly generated seed phrases, the attacker can retrieve your seed phrases which recovers an empty wallet, There is no way he would easily guess your passphrase and he needs to get it correctly to access funds stored in such a wallet. This is why it is recommended to use a passphrase long enough that it is harder to brute-force(25 or more word-length is cool).