1
00:00:00,000 -->
00:00:06,240
Okay, stop what you're doing. If you own a cold card, listen up. This is not a drill.
2
00:00:07,060 -->
00:00:10,780
This is Zach and you're listening to Reads on the Bitcoin Well podcast.
3
00:00:11,440 -->
00:00:15,820
And I'm breaking format today because some things can't wait for a warm welcome.
4
00:00:16,140 -->
00:00:23,340
Here's what happened. Overnight on July 30th, 594 Bitcoin, about $38 million worth,
5
00:00:23,340 -->
00:00:27,840
got swept out of 500 wallets in roughly 25 minutes.
6
00:00:28,460 -->
00:00:29,540
Nobody got fished.
7
00:00:30,000 -->
00:00:31,580
Nobody's device got touched.
8
00:00:32,140 -->
00:00:34,760
The seeds themselves were weak from creation.
9
00:00:35,660 -->
00:00:42,520
A bug in Coldcard's firmware meant the random numbers making people's keys weren't actually random.
10
00:00:43,000 -->
00:00:45,460
And a predictable seed isn't secure.
11
00:00:46,120 -->
00:00:49,240
It's a math problem an attacker can just solve.
12
00:00:49,240 -->
00:00:54,820
I've got a Mark III, so I'm in the danger zone myself, and I didn't sleep last night
13
00:00:54,820 -->
00:01:01,500
until I made sure my device was safe, at least as safe as it could be, and I'm now in the
14
00:01:01,500 -->
00:01:03,340
market for new hardware.
15
00:01:03,340 -->
00:01:07,720
But before we go anywhere, what do you need to do this afternoon?
16
00:01:07,720 -->
00:01:10,080
Or morning, or whenever you're hearing this?
17
00:01:10,080 -->
00:01:17,300
One, if you generated a seed on any cold card from March 2021 on, not just the Mark III,
18
00:01:17,300 -->
00:01:21,020
current model, treat those funds as at risk.
19
00:01:21,020 -->
00:01:22,020
2.
20
00:01:22,020 -->
00:01:27,700
If you had set a BIP39 passphrase when you generated that seed phrase on your wallet,
21
00:01:27,700 -->
00:01:28,700
breathe.
22
00:01:28,700 -->
00:01:33,620
Because that's the one thing the device didn't generate and potentially keeping your safe
23
00:01:33,620 -->
00:01:34,620
funds.
24
00:01:34,620 -->
00:01:35,620
3.
25
00:01:35,620 -->
00:01:41,300
As a stopgap, if you hadn't created a BIP39 passphrase before now, you can do so on your
26
00:01:41,300 -->
00:01:47,200
wallet to generate a brand new seed phrase, which you can then migrate your funds to,
27
00:01:47,200 -->
00:01:51,160
until you have time to get a new wallet or update the device or both.
28
00:01:51,160 -->
00:01:56,820
No, if you do this, that will then be a brand new wallet that you then have to create an
29
00:01:56,820 -->
00:02:02,000
address for in your software, however you have that set up with your cold card.
30
00:02:02,000 -->
00:02:05,560
And then you'll need to move the funds to it and potentially test that you can send
31
00:02:05,560 -->
00:02:10,140
funds from that address before trusting all of your savings to it.
32
00:02:10,140 -->
00:02:12,620
Take your time and relax.
33
00:02:12,620 -->
00:02:16,720
Don't do anything in a panic because that's when you make mistakes.
34
00:02:16,720 -->
00:02:21,760
4. Migrate to a fresh seed on a patched hardware or a brand new device.
35
00:02:21,760 -->
00:02:26,440
Verify your check and receive address on the screen, send a small test amount first, and
36
00:02:26,440 -->
00:02:28,640
make sure you can send it back out again.
37
00:02:28,640 -->
00:02:31,680
And 4. A bad seed stays bad.
38
00:02:31,680 -->
00:02:35,360
Booming it to a treasure or a ledger doesn't fix it.
39
00:02:35,360 -->
00:02:41,480
You need genuinely new keys built from scratch, ideally with added randomness using dice rolls
40
00:02:41,480 -->
00:02:42,720
or other methods.
41
00:02:42,720 -->
00:02:47,400
I busted out all my Dungeons & Dragons and Magic card dice, just getting excited about
42
00:02:47,400 -->
00:02:50,060
all the random dice throws I'm going to be making.
43
00:02:50,060 -->
00:02:55,040
Now that you're safe, let's slow down and actually understand this.
44
00:02:55,040 -->
00:03:00,840
The full timeline, the tiny code mistake that caused it, and the habits that protect you
45
00:03:00,840 -->
00:03:03,180
no matter who makes your wallet.
46
00:03:03,180 -->
00:03:04,180
Questions?
47
00:03:04,180 -->
00:03:08,100
Want me to help you or one of our teammates walk you through your own migration?
48
00:03:08,100 -->
00:03:12,380
Email me at z.adair at bitcoinwell.com.
49
00:03:12,380 -->
00:03:21,100
z.addair at bitcoinwell.com. I will try to answer everyone. Not your keys, not your coins,
50
00:03:21,420 -->
00:03:26,660
and in this case, not real entropy, not your keys. Here's the read.
51
00:03:26,660 -->
00:03:39,700
The Cold Card Hack
52
00:03:39,700 -->
00:03:43,600
A timeline of the $38 million entropy failure
53
00:03:43,600 -->
00:03:45,1000
and how to keep it from happening to you
54
00:03:45,1000 -->
00:03:52,100
594 Bitcoin vanished from 500 wallets in about 25 minutes
55
00:03:52,100 -->
00:03:53,720
Nobody's keys were stolen
56
00:03:53,720 -->
00:03:55,660
Nobody's device was touched
57
00:03:55,660 -->
00:03:59,180
and that is exactly what makes this one so terrifying.
58
00:03:59,740 -->
00:04:02,700
You see, most Bitcoin thefts have a villain you can picture.
59
00:04:03,040 -->
00:04:06,460
A phishing link, a fake support agent, a $5 wrench.
60
00:04:07,120 -->
00:04:10,520
Someone tricks you or someone grabs you and the coins walk out the door.
61
00:04:10,840 -->
00:04:12,100
This one has none of that.
62
00:04:12,440 -->
00:04:14,420
The victims did almost everything right.
63
00:04:14,900 -->
00:04:19,020
They bought a respected hardware wallet, wrote their seed words on paper,
64
00:04:19,640 -->
00:04:24,600
never typed them into a computer, and left their savings in cold storage for years.
65
00:04:24,600 -->
00:04:31,280
Then, in the small hours of July 30th, 2026, the coins left anyway.
66
00:04:31,280 -->
00:04:32,540
All at once.
67
00:04:32,540 -->
00:04:37,440
From hundreds of people who had never met and had nothing in common except one thing,
68
00:04:37,440 -->
00:04:39,900
the device that made their keys.
69
00:04:39,900 -->
00:04:48,980
At 136 UTC on Thursday, July 30th, Bitcoin Block 960188 confirmed the first batch of
70
00:04:48,980 -->
00:04:53,720
what would become one of the most surgical thefts ever recorded on chain.
71
00:04:53,720 -->
00:05:02,640
Over four consecutive blocks, between 960188 through 960191, an automated operation swept
72
00:05:02,640 -->
00:05:05,600
500 separate addresses.
73
00:05:05,600 -->
00:05:23,004
That 1 unspent outputs roughly 594 Bitcoin about 38 million at the time By 151 UTC it was finished The attacker had already funneled those Bitcoin into a single consolidation address
74
00:05:23,184 -->
00:05:27,084
where it still sits as of this writing. Look at the fingerprint of the attack,
75
00:05:27,184 -->
00:05:32,884
and it tells a story. Every drained address was single signature, not one multisig,
76
00:05:32,884 -->
00:05:42,044
not one taproot address. The median victim lost 0.41 Bitcoin, around $26,000 worth. The hardest
77
00:05:42,044 -->
00:05:49,804
hit lost 29.9 Bitcoin, nearly $2 million. And no victim lost less than 1.5 Bitcoin.
78
00:05:50,544 -->
00:05:55,144
That floor might be a tell that the attacker filtered targets by minimum balance.
79
00:05:55,504 -->
00:06:00,344
This was not a spray and pray. Someone had a specific wishlist they were trying to pull.
80
00:06:00,344 -->
00:06:05,484
The whole operation cost about .044 Bitcoin in fees.
81
00:06:06,284 -->
00:06:11,584
Whoever did this walked away with $38 million and paid roughly $2,800 in postage.
82
00:06:11,984 -->
00:06:16,384
The first alarm didn't come from a researcher or a company, it came from a victim.
83
00:06:16,764 -->
00:06:20,124
About 12 hours later, a user posted to Reddit under the title,
84
00:06:20,304 -->
00:06:22,604
Full Panic, One of My Wallets Was Drained.
85
00:06:22,824 -->
00:06:26,084
The comments pieced together a heartbreakingly ordinary story.
86
00:06:26,084 -->
00:06:31,904
A cold card bought in 2021, a 24-word seed generated on the device.
87
00:06:32,464 -->
00:06:34,804
Savings moved over, then years of quiet.
88
00:06:35,244 -->
00:06:41,644
In January of last year, they bought a second cold card and re-entered the old words to make sure they were correct.
89
00:06:42,044 -->
00:06:47,244
The seed had never touched the computer, only the device, a watch-only wallet on Sparrow,
90
00:06:47,564 -->
00:06:50,904
and automatic withdrawal from an exchange to the same address.
91
00:06:51,344 -->
00:06:55,624
That night, the address got swept, along with 499 others.
92
00:06:55,984 -->
00:06:57,224
Here's where it gets messy.
93
00:06:57,424 -->
00:06:59,124
About four hours after that post,
94
00:06:59,364 -->
00:07:02,764
Kevin Loak, co-founder of Wizard Sardine,
95
00:07:03,024 -->
00:07:04,604
the team behind the Liana wallet,
96
00:07:04,864 -->
00:07:07,724
asked his followers with a cold card to check their balances.
97
00:07:08,464 -->
00:07:09,084
His words,
98
00:07:09,484 -->
00:07:12,304
Hoping this is a nothing burger, but doing my job here.
99
00:07:13,044 -->
00:07:15,444
90 minutes later, the tone had changed completely.
100
00:07:15,904 -->
00:07:17,544
Quote, this is not a drill.
101
00:07:18,024 -->
00:07:20,644
Confirmations rolled in from names the community trust.
102
00:07:20,644 -->
00:07:23,704
The developer known as Grubles confirmed a case.
103
00:07:24,344 -->
00:07:27,024
Jameson Lopp reported partial thefts,
104
00:07:27,304 -->
00:07:30,084
wallets where only some outputs had been pulled,
105
00:07:30,464 -->
00:07:31,444
not the whole balance.
106
00:07:31,804 -->
00:07:33,904
Loak noted that the victims included
107
00:07:33,904 -->
00:07:36,164
multiple real and known Bitcoiners.
108
00:07:36,324 -->
00:07:39,304
The comforting theory that one careless person got phished,
109
00:07:39,544 -->
00:07:41,144
something systemic was in play.
110
00:07:41,564 -->
00:07:43,764
Less than an hour after all the theorizing,
111
00:07:44,164 -->
00:07:46,324
NVK, or Rodolfo Novak,
112
00:07:46,424 -->
00:07:48,584
the founder and CEO of CoinKite,
113
00:07:48,584 -->
00:07:51,604
the company that makes Coldcard, responded,
114
00:07:51,864 -->
00:07:52,084
quote,
115
00:07:52,164 -->
00:07:52,944
No need to panic.
116
00:07:52,944 -->
00:07:57,784
Someone loaded a compromised seed onto a cold card and or the seed leaked.
117
00:07:58,424 -->
00:08:03,004
This is part of a broader attack involving 500 private keys from different wallets.
118
00:08:03,804 -->
00:08:05,284
In other words, not our device.
119
00:08:05,464 -->
00:08:06,844
These were bad seeds from elsewhere.
120
00:08:07,284 -->
00:08:11,724
Now, I want to be fair to NVK here because I think he was doing what a founder does at
121
00:08:11,724 -->
00:08:14,784
hour 16 of a crisis with incomplete data.
122
00:08:15,424 -->
00:08:20,584
He was pattern matching to the last 100 incidents, which usually are leaked seeds.
123
00:08:20,584 -->
00:08:25,764
But in this case, he was wrong, and to his credit, he said so and has since apologized.
124
00:08:26,384 -->
00:08:31,464
As the picture sharpened, he pulled back the initial call, telling followers he didn't want
125
00:08:31,464 -->
00:08:36,404
bad information circulating while people were at risk and put the whole team on it.
126
00:08:36,684 -->
00:08:41,424
Quote, we are all hands on deck doing a deep dive on everything technical post soon.
127
00:08:42,164 -->
00:08:45,584
Meanwhile, the on-chain analysts were closing in on the real answer.
128
00:08:45,844 -->
00:08:49,284
Rob Hamilton, CEO of Anchor Watch, ran the numbers.
129
00:08:49,284 -->
00:08:58,744
1,324 outputs, all single SIG, dating from 2021 to 2026, not on Taproot. His read was,
130
00:08:59,244 -->
00:09:04,784
at first glance, it appears there was faulty entropy in wallet generation somewhere along
131
00:09:04,784 -->
00:09:10,264
the path. Faulty entropy. Hold on to that phrase, we'll come back. By the end of the day,
132
00:09:10,344 -->
00:09:16,764
on July 30th, CoinKite published a formal Mark III security advisory. No more hedging. The warning
133
00:09:16,764 -->
00:09:23,524
was blunt. Any user who generated a seed on a cold card Mark III running firmware version 4.01,
134
00:09:23,884 -->
00:09:32,784
sorry, 4.0.1, or later, should treat their funds as at-risk. The flaw runs through firmware 5.0.3,
135
00:09:33,024 -->
00:09:38,264
the final release that supported the Mark III. The advisory carried one piece of very good news
136
00:09:38,264 -->
00:09:44,424
and one clear set of instructions. The good news, if you protected your Mark III with a BIP39
137
00:09:44,424 -->
00:09:51,564
passphrase, CoinKite's early analysis said your funds are at minimal risk. Why? Because the passphrase
138
00:09:51,564 -->
00:09:57,284
is the one ingredient the device doesn't generate. More on that shortly because it's the single most
139
00:09:57,284 -->
00:10:03,224
important concept in this whole thing. The instructions. If the Mark III is your only device,
140
00:10:03,444 -->
00:10:09,904
create a strong, unique BIP39 passphrase on it and move funds to the new passphrase protected
141
00:10:09,904 -->
00:10:15,244
wallet as an interim measure. For a cleaner fix, generate a fresh seed on an unaffected
142
00:10:15,244 -->
00:10:35,488
cold card or for the advanced and careless use the MK3 dice import path with at least 99 rolls of fair die which bypasses the device broken generator entirely And the line that should be tattooed on every self guide ever written migrate calmly
143
00:10:35,728 -->
00:10:37,108
We say that a lot around here.
144
00:10:37,588 -->
00:10:42,368
Rushing a wallet migration can create a more immediate risk than the issue you're trying
145
00:10:42,368 -->
00:10:43,588
to address in the first place.
146
00:10:43,588 -->
00:10:50,468
So verify every backup, every address, every fingerprint and send a small test transaction
147
00:10:50,468 -->
00:10:52,408
before you move the rest.
148
00:10:52,408 -->
00:10:56,828
And personally, I also want to test sending from the new wallet before I just move all
149
00:10:56,828 -->
00:10:59,308
my funds into it in a panic.
150
00:10:59,308 -->
00:11:04,788
Which I calmly did last night by the way because I also have a Mark III that's potentially
151
00:11:04,788 -->
00:11:05,788
at risk.
152
00:11:05,788 -->
00:11:10,468
Alongside the advisory, CoinKite published a companion technical backgrounder, link will
153
00:11:10,468 -->
00:11:11,588
will be in the show notes.
154
00:11:12,148 -->
00:11:15,528
And it contains one of the most disarmingly honest admissions
155
00:11:15,528 -->
00:11:18,668
I have ever seen from a hardware maker mid-crisis.
156
00:11:18,988 -->
00:11:22,148
NVK wrote that most of the randomness on the cold card
157
00:11:22,148 -->
00:11:25,588
was coming from a software PRNG that, quote,
158
00:11:26,388 -->
00:11:29,348
I didn't know was actually in the source code base.
159
00:11:29,968 -->
00:11:32,288
Inherited from a MicroPython submodel,
160
00:11:32,288 -->
00:11:36,168
the hand-built hardware TRNG he had carefully written
161
00:11:36,168 -->
00:11:38,448
was still running, but, quote,
162
00:11:38,448 -->
00:11:41,828
just by chance and only for less important things, unquote.
163
00:11:42,328 -->
00:11:45,208
So the founder of one of the most respected names in Bitcoin,
164
00:11:45,388 -->
00:11:48,808
self-custody, didn't know which random number generator
165
00:11:48,808 -->
00:11:50,608
his own seeds were actually using.
166
00:11:51,148 -->
00:11:52,248
Not because he was careless,
167
00:11:52,488 -->
00:11:54,948
but because two functions shared the same name
168
00:11:54,948 -->
00:11:57,168
and the wrong one quietly won.
169
00:11:57,928 -->
00:12:00,908
CoinKite said Mark 4Q and Mark 5 were not affected
170
00:12:00,908 -->
00:12:02,208
based on early analysis,
171
00:12:02,488 -->
00:12:06,208
but that turned out to be true for only the specific theft,
172
00:12:06,208 -->
00:12:12,448
but incomplete for the underlying bug. Enter Block. Jack Dorsey's company Block on the same day,
173
00:12:12,728 -->
00:12:18,288
their engineering and security teams published an independent technical analysis link also in show
174
00:12:18,288 -->
00:12:24,468
notes written with anonymous security researchers. This is the document that turns a scary headline
175
00:12:24,468 -->
00:12:30,388
into an understandable failure and it's worth slowing down for because the mechanism is a small
176
00:12:30,388 -->
00:12:36,548
masterpiece of how these big disasters hide inside tiny mistakes, which I know we all make.
177
00:12:36,548 -->
00:12:41,508
Here's the chain of events and playing language. A cold card is supposed to generate your seed
178
00:12:41,508 -->
00:12:49,188
using a true hardware random number generator, RNG, a dedicated circuit in the STM32 chip that
179
00:12:49,188 -->
00:12:54,708
produces genuine physical randomness. CoinKite wrote their own wrapper for that hardware,
180
00:12:54,708 -->
00:13:01,508
which is good practice. To avoid a conflict, the production build sets a configuration flag to zero,
181
00:13:01,508 -->
00:13:06,788
telling the underlying MicroPython system, don't use your built-in RNG, we've got our own.
182
00:13:06,788 -->
00:13:13,428
Now the bug, a separate library the firmware relies on called libngu, needed to check whether
183
00:13:13,428 -->
00:13:19,428
that hardware RNG was available. It checked whether the flag was defined or whether it was enabled.
184
00:13:19,428 -->
00:13:26,068
The flag was defined, its value was zero, meaning off, but the check only asked, does it exist?
185
00:13:26,688 -->
00:13:27,788
And the answer was yes.
186
00:13:28,068 -->
00:13:30,568
So the build completed with no error and no warning,
187
00:13:30,968 -->
00:13:37,268
and quietly wired the seed generator from MicroPython software back into the hardware chip.
188
00:13:37,528 -->
00:13:39,028
And what is that fallback software?
189
00:13:39,428 -->
00:13:44,388
A small non-cryptographic pseudorandom generator called Yasmereng
190
00:13:44,388 -->
00:13:49,168
seeded from the chip's fixed serial number and a couple of timer registers.
191
00:13:49,428 -->
00:13:56,008
Those aren't secret. The serial number is factory set metadata. The timers are predictable startup state.
192
00:13:56,008 -->
00:14:02,428
Feed a predictable input into a predictable algorithm and you get a predictable output that merely looks random.
193
00:14:02,568 -->
00:14:05,768
It passes the eye test but fails in reality.
194
00:14:06,168 -->
00:14:12,228
Block laid out the consequences by device and this is where it gets worse than the CoinKite advisory suggested.
195
00:14:12,228 -->
00:14:15,848
On the Mark 2 and Mark 3 running the version 4 firmware,
196
00:14:15,848 -->
00:14:23,008
There is essentially no real cryptographic entropy at all for a known device and startup state seed generation is effectively
197
00:14:23,448 -->
00:14:24,488
deterministic
198
00:14:24,488 -->
00:14:30,268
CoinKite's own follow-up put the effective search space around 2 to the 40th power 40 bits
199
00:14:30,748 -->
00:14:34,608
against the 2 to the 128th power 128 bits a
200
00:14:35,088 -->
00:14:41,668
12-word seed is supposed to have an attacker with the right setup doesn't get your seed out of an impossible ocean of
201
00:14:41,668 -->
00:14:46,468
possibilities, they just compute it from the limited number that they can see are available.
202
00:14:46,768 -->
00:14:53,228
On the current Mark IV Q and Mark V, it is better but still broken. A boot time reseed pulls entropy
203
00:14:53,228 -->
00:14:59,908
from the secure elements, but the code keeps only 32 bits of it. That caps the meaningful search
204
00:14:59,908 -->
00:15:07,008
space at about 2 to the 32nd power, roughly 4 billion possibilities or around 2 to the 72nd
205
00:15:07,008 -->
00:15:10,128
power total once you account for the timing states.
206
00:15:10,128 -->
00:15:14,888
4 billion sounds like a lot until you remember that modern hardware chews through numbers
207
00:15:14,888 -->
00:15:16,888
like that for breakfast.
208
00:15:16,888 -->
00:15:21,928
CoinKite calls this a material improvement that still does not reach the target, which
209
00:15:21,928 -->
00:15:24,788
is a polite way of saying, don't rely on it.
210
00:15:24,788 -->
00:15:29,348
Let me be blunt about the scope, because the early headlines fixated on the Mark III and
211
00:15:29,348 -->
00:15:31,648
that is genuinely misleading.
212
00:15:31,648 -->
00:15:44,612
This is not a Mark III problem it a cold card problem current model the Mark IV the Q and the Mark 5 generated weakened seeds too just with more entropy than the Mark 3 near deterministic worst case
213
00:15:44,612 -->
00:15:49,992
The theft happened to hit Mark 3 early single sig wallets, so the Mark 3 grabbed the spotlight,
214
00:15:50,532 -->
00:15:56,352
but if you generated a seed on any cold card for March 2021 onward, you are in the scope.
215
00:15:56,352 -->
00:16:04,652
What is genuinely clear? The Mark 1 or any Mark 2, Mark 3 seed made on firmware before 4.0,
216
00:16:04,852 -->
00:16:09,832
those used the real hardware generator, and the non-cold card products TapSigner,
217
00:16:10,072 -->
00:16:16,172
OpenDime, and SatsCard, which run different code entirely. Everything else made in the last four
218
00:16:16,172 -->
00:16:21,592
plus years should be treated as suspect until you have migrated. The regression entered in a single
219
00:16:21,592 -->
00:16:29,272
commit date, March 1st, 2021, shipped in firmware version 4 on March 17th, 2021, and the partial
220
00:16:29,272 -->
00:16:36,212
Mark 4 reseed was added a year later in March 2021 without ever fixing the root cause. For over
221
00:16:36,212 -->
00:16:42,232
four years, seeds were being born weak and nobody noticed. The same weak generator also touches paper
222
00:16:42,232 -->
00:16:50,252
wallet keys, seed ZorMAS, cloning and USB encryption, key teleport, web 2FA, and secure
223
00:16:50,252 -->
00:16:55,572
notes passwords. The rot ran deep because everything drank from the same poison well.
224
00:16:55,852 -->
00:17:00,852
One correction worth making since it's already circulating wrong, you will see an eight-year-old
225
00:17:00,852 -->
00:17:06,052
bug figure in some coverage, but that's not quite right and CoinKite pushed back on it directly.
226
00:17:06,052 -->
00:17:11,432
The vulnerable MicroPython fallback code was added upstream back in May 2018,
227
00:17:11,852 -->
00:17:17,452
so the code is eight years old, but it didn't enter cold card seed generation until March 2021
228
00:17:17,452 -->
00:17:23,452
migration. Affected seeds go back a little over four years, not eight. The distinction matters
229
00:17:23,452 -->
00:17:28,452
if you're trying to figure out whether your own wallet is exposed. And here's the part that should
230
00:17:28,452 -->
00:17:34,312
keep every auditor up at night. Coldcard's firmware is fully open source and has been reviewed,
231
00:17:34,492 -->
00:17:40,212
including by Coinkite itself. So how did this survive eight years of eyes on the code? Because
232
00:17:40,212 -->
00:17:45,892
the reviews confirm the correct hardware TRNG was present in the compiled binary, but it never
233
00:17:45,892 -->
00:17:51,212
verified which of the two identically named functions the seed generation path actually
234
00:17:51,212 -->
00:17:52,212
reached.
235
00:17:52,212 -->
00:17:55,272
The good code was there, it just wasn't getting utilized.
236
00:17:55,272 -->
00:17:59,732
Present isn't the same as used and an audit that checks the former while assuming the
237
00:17:59,732 -->
00:18:03,232
latter can pass a broken system with flying colors.
238
00:18:03,232 -->
00:18:06,932
So where do we stand as of this afternoon on July 31st?
239
00:18:06,932 -->
00:18:15,852
CoinKite shipped an emergency hotfix overnight, firmware 5.6.0 for the MK4 and MK5, and 1.5
240
00:18:15,852 -->
00:18:18,492
0.0 for the queue.
241
00:18:18,492 -->
00:18:23,672
It adds no new features, it just generates entropy correctly, and it does so with a fix
242
00:18:23,672 -->
00:18:27,512
that is almost poetic in how directly it answers the bug.
243
00:18:27,512 -->
00:18:32,492
The build now explicitly refuses to include the MicroPython fallback and adds a compile
244
00:18:32,492 -->
00:18:38,772
time check that fails unless the correct hardware RNG is the one actually wired in.
245
00:18:38,772 -->
00:18:44,072
The exact same blind spot that let this ship for 4 years is now just a build error.
246
00:18:44,072 -->
00:18:48,412
By the way, something important to know in all of this is updating your firmware doesn't
247
00:18:48,412 -->
00:18:52,712
repair a seed that was already created on the device.
248
00:18:52,712 -->
00:18:54,672
The weak seed already exists.
249
00:18:54,672 -->
00:19:00,232
A patch stops making new seeds going forward from being bad, but it doesn't heal the issue
250
00:19:00,232 -->
00:19:02,992
you have with your current seed phrase.
251
00:19:02,992 -->
00:19:08,112
Anyone with funds under an affected seed still need to migrate to a brand new seed generated
252
00:19:08,112 -->
00:19:11,672
on patched hardware, or on another device, probably.
253
00:19:11,672 -->
00:19:17,332
The Mark III is out of support, so its owners, like myself, are pointed to the separate migration
254
00:19:17,332 -->
00:19:18,612
path in the advisory.
255
00:19:18,932 -->
00:19:25,332
Block's hardware lead Max Guise, also what a great name that is, Max Guise, urged anyone
256
00:19:25,332 -->
00:19:31,052
exposed to move funds as soon as they safely can and confirmed that no Block products are
257
00:19:31,052 -->
00:19:31,532
affected.
258
00:19:31,892 -->
00:19:37,492
Trezor, a competitor, told its own users their funds are safe, while making another similar
259
00:19:37,492 -->
00:19:43,452
point like I made earlier that a seed created on an affected cold card stays weak even if you
260
00:19:43,452 -->
00:19:48,992
restore it onto a different brand of device. The weakness lives in the numbers, not the hardware.
261
00:19:49,312 -->
00:19:55,832
There is a strange quietness in the aftermath of this. The stolen 594 Bitcoin hasn't moved.
262
00:19:56,752 -->
00:20:03,072
562 sit untouched in that consolidation address, another 32 on an intermediate hop,
263
00:20:03,072 -->
00:20:07,492
and not a single Satoshi has gone toward an exchange or a mixer.
264
00:20:07,492 -->
00:20:10,712
The attacker is sitting on $38 million in the open
265
00:20:10,712 -->
00:20:14,772
and the next time those coins twitch will be the first real clue to who holds them.
266
00:20:15,092 -->
00:20:19,452
I also don't think it will be so easy for the thief to even use the stolen funds.
267
00:20:19,732 -->
00:20:22,512
He may also be noticing how much attention he received
268
00:20:22,512 -->
00:20:24,572
and planning his next moves more carefully.
269
00:20:24,872 -->
00:20:29,272
And then there is the detail that makes 2026 feel like, well, current year.
270
00:20:29,272 -->
00:20:34,852
CoinKite says it has to assume the attacker used AI to comb through old versions of its
271
00:20:34,852 -->
00:20:38,152
open source firmware and find the flaw.
272
00:20:38,152 -->
00:20:39,152
The gut punch?
273
00:20:39,152 -->
00:20:44,832
The company says it ran one of the best available AI models over its own code just weeks earlier,
274
00:20:44,832 -->
00:20:49,052
and the model didn't find this bug or anything serious.
275
00:20:49,052 -->
00:20:49,972
Same tools.
276
00:20:50,016 -->
00:20:55,816
both sides of the fight, but this time, in CoinKite's words, it didn't help them, it only helped the bad guys.
277
00:20:56,196 -->
00:21:01,796
So now that we've gone through that, let's pull back from the timeline because the mechanism here is older than Bitcoin.
278
00:21:02,216 -->
00:21:05,476
Ayn Rand built her entire philosophy on three words.
279
00:21:05,996 -->
00:21:07,156
A is A.
280
00:21:07,916 -->
00:21:15,336
A thing is what it is, regardless of what you wish it to be, regardless of how it looks, reality doesn't bend to hope.
281
00:21:15,756 -->
00:21:19,736
Her constant instruction to the confused was, check your premises.
282
00:21:20,016 -->
00:21:27,276
because when you hit a contradiction, there is either a lie or an error in your data or something wrong with your starting assumptions.
283
00:21:27,796 -->
00:21:32,656
That is this whole disaster in a sentence. Everyone in the chain assumed a premise that was false.
284
00:21:33,416 -->
00:21:39,556
The library assumed a defined flag meant an enabled flag. The build assumed no error meant no problem.
285
00:21:40,096 -->
00:21:46,976
And hundreds of users trusted that a number which looked random was random, without taking any steps to increase that randomness.
286
00:21:46,976 -->
00:21:53,276
myself included. But a predictable number wearing a costume of randomness is still predictable.
287
00:21:53,856 -->
00:22:01,396
A is A. The seed looked like 128 bits of entropy and behaved like 40. And reality,
288
00:22:01,636 -->
00:22:05,876
in the form of an attacker with a script, collected the difference. This is why the
289
00:22:05,876 -->
00:22:12,396
Austrian tradition is so allergic to appearances standing in for substance. Randomness can't be
290
00:22:12,396 -->
00:22:19,036
faked, only genuinely produced or genuinely absent. There is no in-between that survives contact with
291
00:22:19,036 -->
00:22:25,176
a determined adversary. The seed is the foundation your entire financial sovereignty rests on,
292
00:22:25,176 -->
00:22:31,896
and a foundation is not probably solid. It either is or it isn't. Now there was something that saved
293
00:22:31,896 -->
00:22:37,616
some people in this situation, and a lot of cold card owners might get this wrong, so listen to this
294
00:22:37,616 -->
00:22:51,434
carefully Your pin is not your passphrase The pin unlocks the physical device It has nothing to do with this current bug The BIP39 passphrase sometimes called the 25th word because it an
295
00:22:51,434 -->
00:22:56,734
extra word, is completely different. It's an extra secret you supply that gets combined with your
296
00:22:56,734 -->
00:23:02,494
seed to derive an entirely separate wallet. Change one character and you get a totally different
297
00:23:02,494 -->
00:23:08,994
wallet. Why did a passphrase protect people here? Because the device never generates it. You do.
298
00:23:09,454 -->
00:23:15,174
It's the one input the broken random number generator didn't touch. An attacker can recompute
299
00:23:15,174 -->
00:23:20,854
your weak seed from public data all day long, but without the passphrase that lives only in your
300
00:23:20,854 -->
00:23:26,554
head and your backup, the recomputed seed unlocks an empty wallet. The passphrase survived the
301
00:23:26,554 -->
00:23:32,214
entropy failure precisely because it never depended on the device's entropy in the first
302
00:23:32,214 -->
00:23:39,294
place. Most people know their pen. Far fewer set a passphrase. That gap is the entire attack surface.
303
00:23:39,954 -->
00:23:45,974
Every single drained wallet was a passphrase-free single-seed SIG. So what do you do right now if
304
00:23:45,974 -->
00:23:51,834
you own a cold card? Well, calm and careful beats fast and panicked, first of all. A rush migration
305
00:23:51,834 -->
00:23:58,194
is its own attack vector. So work through these steps deliberately. You can also read this online
306
00:23:58,194 -->
00:24:04,094
at bitcoinwell.com slash blog if you'd rather have it written down. Number one, figure out which
307
00:24:04,094 -->
00:24:10,094
firmware made your seed. Exposure depends on the firmware version in use when the seed was generated,
308
00:24:10,414 -->
00:24:18,154
not the device's age or its current firmware. Mark 2 or Mark 3 seeds from version 4.0.0
309
00:24:18,154 -->
00:24:22,954
through version 5.0.3 are the highest risk.
310
00:24:22,954 -->
00:24:26,634
Mark IV, Mark Q and Mark V seeds are reduced,
311
00:24:26,634 -->
00:24:28,434
but still really risky.
312
00:24:28,434 -->
00:24:42,692
Step two if you have a bit 39 passphrase you are in far better shape Keep protecting it never type it into a website phone or computer and it doing the heavy lifting for now Step 3 Migrate to a fresh seed on patched
313
00:24:42,692 -->
00:24:48,132
hardware. Update to the hotfix if you have one available then generate a new seed. Better yet,
314
00:24:48,132 -->
00:24:55,812
add entropy you control at least 99 dice rolls, a strong passphrase or both. Step 4. Verify before
315
00:24:55,812 -->
00:25:01,892
you trust. Record the new wallet's fingerprint, verify or receive address on the device screen,
316
00:25:01,892 -->
00:25:07,492
and send a small test transaction. Confirm it arrives before moving the rest and keep your old
317
00:25:07,492 -->
00:25:14,452
backup until the migration is fully confirmed. Step five, remember a bad seed stays bad. Moving
318
00:25:14,452 -->
00:25:20,452
it to a treasure or a ledger or a new cold card doesn't fix that. You need a genuinely new seed.
319
00:25:20,452 -->
00:25:25,652
If your affected wallet is already empty and you have moved on to a fresh seed elsewhere,
320
00:25:25,652 -->
00:25:30,852
you're done. The risk lives only in wallets still holding funds under a seed with broken
321
00:25:30,852 -->
00:25:36,052
firmware produced. Now some safety habits that will protect any device from any maker.
322
00:25:36,052 -->
00:25:41,972
Add a passphrase. It layers a secret the device can never leak and, as we just saw,
323
00:25:41,972 -->
00:25:47,332
it is sometimes a difference between a scare and a catastrophe. Contribute your own entropy
324
00:25:47,332 -->
00:25:52,292
with dice when you can, so you're not trusting a black box to be honest about its randomness.
325
00:25:52,292 -->
00:25:57,572
Always verify receive addresses on the device's own screen, never on your computer.
326
00:25:57,572 -->
00:26:01,812
Test every new wallet with a small amount before you commit real savings,
327
00:26:01,812 -->
00:26:07,652
and make sure you can both send and receive from the new device before committing all of your funds.
328
00:26:07,652 -->
00:26:12,292
Buy hardware directly from the manufacturer and verify firmware signatures.
329
00:26:13,012 -->
00:26:17,172
Keep firmware current, but understand what a patch can and can't undo,
330
00:26:17,172 -->
00:26:20,452
like a bad seed phrase that's already been created.
331
00:26:20,452 -->
00:26:36,070
And the big one the structural fix multi ideally across multiple vendors Look back at the cold card sweep not one multi wallet was touched A two of three setups spread across different manufacturers means a flaw in any single device
332
00:26:36,070 -->
00:26:42,610
or any single firmware, or any single company's random number generator can't drain you on
333
00:26:42,610 -->
00:26:43,610
its own.
334
00:26:43,610 -->
00:26:47,830
It's the don't trust verify principle turned into architecture.
335
00:26:47,830 -->
00:26:56,850
You stopped betting your entire stack on one team's code review, and this month showed us that even excellent teams running AI over their own code miss things.
336
00:26:57,130 -->
00:27:00,030
Treat your custody as a practice, not a purchase.
337
00:27:00,710 -->
00:27:05,310
The 2021 buyers who got swept did the setup once and never looked back.
338
00:27:05,870 -->
00:27:11,090
Sovereignty isn't just a product that you own, it's a discipline that you keep up with or you don't.
339
00:27:11,090 -->
00:27:16,350
The whole promise of self-custody is that you remove your dependence on trusted third parties.
340
00:27:16,350 -->
00:27:20,850
No bank, no exchange, no custodian standing between you and your money.
341
00:27:21,570 -->
00:27:24,430
That promise is real and it's worth everything.
342
00:27:24,850 -->
00:27:30,390
Bitcoin is still the only major asset that lets an ordinary person hold bearer wealth
343
00:27:30,390 -->
00:27:33,310
with no permission slip and no counterparty.
344
00:27:33,570 -->
00:27:35,790
But trustless doesn't mean effortless.
345
00:27:36,290 -->
00:27:40,010
When you fire the middleman, you also inherit his job.
346
00:27:40,730 -->
00:27:44,630
The cold card failure is not an argument against self-custody.
347
00:27:45,250 -->
00:27:49,250
It's an argument for doing it with the seriousness that it deserves.
348
00:27:49,990 -->
00:27:52,570
Verify your entropy, layer your defenses,
349
00:27:52,970 -->
00:27:56,770
and never let a thing's appearance stand in for its substance.
350
00:27:57,090 -->
00:28:00,210
A is A, B is not A.
351
00:28:00,570 -->
00:28:04,330
Your keys are only truly yours when no one else can compute them.
352
00:28:04,950 -->
00:28:07,170
Not your keys, not your coins.
353
00:28:07,490 -->
00:28:10,650
Not real entropy, not your keys.
354
00:28:10,650 -->
00:28:16,110
At Bitcoin Well, we build for the person who wants to hold their own keys the right way,
355
00:28:16,330 -->
00:28:19,030
with self-custody that puts you in control.
356
00:28:19,490 -->
00:28:20,190
Thanks for listening.
