Interesting topic, but I don’t like this writing style. It’s a lot of words to say very little and repeats sentence structure often. The author assumes the reader knows about this hack already, and doesn’t not provide context on what it is, or details like why the attacker is storing coins in 4,000+ wallets.
It's crazy how many catastrophic security bugs are just "somebody finally bothered to look".
The way AI is advancing what is growing is the ability to look far and wide.
88M is minor by crypto hack standards, and the "cost basis" of the holders on these cards started at a fraction of that, perhaps that is why nobody bothered to find this bug earlier, it's a very niche product.
The Bitcoin communities seem to really be struggling with this hack. The people losing their coins in this case were following best practices. Typically when someone loses their coins there’s a big pile-on to victim blame them for making some mistake. I think it’s comforting to others to be able to identify a mistake someone else made and then convince yourself that you’re too smart to make the same mistake.
In this case, there isn’t much of a mistake to point out. I’ve seen a couple attempts from people trying the told-you-so routine using some arguments about multisig wallets as the only option, but mostly it looks like people are panicking and wondering if their choice of wallet has some undiscovered vulnerability waiting to be exploited. I mostly try to stay away from Bitcoin communities but in events like this it spills over everywhere. I feel sorry for anyone who lost coins, of course, but it’s also interesting to watch the communities grapple with reconciling their appreciation for irreversible key-based transactions with the realities of how this works when their money is on the line. The old ideas about having perfect OPSEC and being smarter than the other coiners are starting to get weakened with examples like this.
My guess is that the next phase is to revise history and form a consensus that Coldcard was never a recommended wallet and that it was obvious to everyone with good OPSEC at the time.
5% of btc users use a hardware wallet and Cardkite wasn't even in the top 5 MFGs as far as i'm aware.
also as far as I care the btc community members who chose to go with one of the few hardware wallets that wasn't open source were not doing due their diligence.
>My guess is that the next phase is to revise history and form a consensus that Coldcard was never a recommended wallet and that it was obvious to everyone with good OPSEC at the time.
if that's a worry just search for things far before the exploit date; lots of unhappiness around cardkite for a while now -- but to be clear, it's nowhere near a revision.
> also as far as I care the btc community members who chose to go with one of the few hardware wallets that wasn't open source were not doing due their diligence.
That’s how the retroactive victim blaming always works: It is retroactively determined that there were signs, which turns into victim blaming anyone who didn’t predict that those signs would lead to loss of their coins.
You are doing it.
> also as far as I care the btc community members who chose to go with one of the few hardware wallets that wasn't open source were not doing due their diligence.
I can’t tell if you’re confused about the details of this story or if you’re trying to make a point that isn’t landing. You may want to read up on the open source status of the wallet before doing the whole victim blaming song and dance.
Cold wallet was definitely recommended late 2025, along with the meme of using dice to generate the entropy. Ledger wasn't recommended by coldcard definitely was
Did the dice method prevent this attack? I only skimmed about it being that the seed was mistakenly using 40 bits of entropy but I don't know at which point of the generation the bug was.
> In this case, there isn’t much of a mistake to point out.
I don’t buy this. There is no $249 device that I would trust with even 1 BTC. These folks looked at the options to preserve $100,000 and picked a $249 device over an exchange. Or a bank. Or the DOW.
It is heartbreaking the loss that some have suffered. But it doesn’t benefit anyone to say “Who could have known?” Everyone knew: because not one person said “I have verified this product and it cannot possibly be vulnerable”. So “it’s open source and you can verify it yourself!” Ok. Nobody did! “Well maybe they did, they just didn’t find the exploit” - that’s the point!
> My guess is that the next phase is to revise history and form a consensus that Coldcard was never a recommended wallet and that it was obvious to everyone with good OPSEC at the time.
Yeah. I didn’t use it. I would never use it. The problem is that “everyone with good OPSEC” are “obviously just plants of Big Bank and the IRS”. The criminals that benefit from “normal” people “legitimizing” bitcoins have really good PR department.
> I don’t buy this. There is no $249 device that I would trust with even 1 BTC. These folks looked at the options to preserve $100,000 and picked a $249 device over an exchange. Or a bank. Or the DOW.
Bitcoin communities have been advocating for hardware wallets over exchanges for a long time. The phrase goes “not your wallet, not your coins”
Yeah. It’s propaganda. It ought to be “Not your code? Not hardware you designed and built? Not your coins.” But then like ten people could safely own BTC. BTC is a criminal conspiracy that requires fools for legitimacy.
> but the fact that there are three waves in the attack shows the level of coordination and pre-planning that was involved in making it happen.
That's a strange interpretation. If it was planned well, why weren't all affected addresses drained as quickly as possible? I would have continuously emptied all vulnerable addresses, from highest to lowest without taking a break in the middle.
> Instead of picking the lowest cost option, the attacker appears to be prioritizing speed in an apparent move to make themselves as untraceable as possible.
I don't see how higher fees would make the attacker less traceable. If anything, the unusually high fees stand out. Though in the long run defenders will enumerate all the vulnerable source addresses anyway, so the affected coins are inherently traceable (at least until laundered).
More likely they prioritized speed to beat other attackers, now that the vulnerability is public. No matter if this was the original attacker or a competitor.
It doesn't appear that Coinkite, the company behind ColdCard products, had a mature senior engineer in the loop. At least, no engineer who could immediately flag such sloppy code commit practices. This sort of thing is ongoing, as we can see in commits made this week, even.
Clearly seems like a corporate culture issue. A very low bar seems standard practice.
I guess even when code is public nobody really reads the history very thoroughly. You'd think someone would've made stink about a company willing to show the world how they were fiddling with low-level random generation stuff with commits like `x` and `runs` in the early life of the project, without much discussion of the safety of the crypto code. We hear "don't roll your own crypto!" a lot... but in a world where there are any number of products on the market, with any number of visibility to various people, open source doesn't make all bugs shallow because there aren't anywhere near enough helpful eyeballs for most project. But probably gave some people false sense of confidence.
A few people did call out Coinkite for poor engineering at the time but it was either not seen or dismissed as hating in the context of the Coldcard/Passport fight.
2. For each seed, generate a few addresses using BIP-32.
3. Use a blockchain explorer API to check if those addresses have been used.
4. For each address that contains unspent coins, generate the corresponding private key (again using BIP-32) then create a transaction sending the coins to the attacker.
There's still some small part of me hoping that the later waves are whitehats and the reason they're keeping everything in segmented addresses is because they hope to find a way to return the funds.
Don't know much about bitcoin, but if they know which numerical wallet it came from, can't send it back even if they don't know the person who owned it or communicating with that owner?
Like if I woke up one morning and found money in my bank account that wasn't supposed to be there, I could just tell the bank to send it back where it came from.
The original wallet is compromised so if you send the money back the attacker can immediately re-steal it. The original owner could try to out-RBF the attacker but game theoretically that leads to the money being converted to miner fees.
The underlying issue here is that addresses created by the tool at fault can have their private key derived from public data. If you send it back, it'll just get stolen again. Furthermore, the typical way that someone proves ownership of an address is by making a transaction from that address with parameters set via private communication with someone else. But since the private key is knowable, anyone can do that. There's no generic way to prove ownership of an address if the private key associated with that address can be determined by an attacker.
The STM32 in the ColdCard has a 96-bit UID "fused" at the factory. The lower 32 bits of this are seeded into the Yasmarang PRNG's initial state. Possession of a ColdCard with a UID matching a contested wallet might be able to serve as evidence of ownership.
It’s one of the reasons why mainstream adoption has failed: most people lack the hubris needed to say they’ll be “smarter” than everyone else and have perfect OPSEC, run their own bank-grade security, etc. — especially since it costs more to take on those extra risks and inconvenience.
That said, there’s a lot of speculation and money laundering which provides a floor on prices. If you look at the historical numbers it looks like the whales will somewhat reliably step in around $60k to reverse a decline, which suggests there’s a benefit for some of them around that price. If you’re canny, you can probably make a decent return but I wouldn’t spend any money you can’t afford to lose.
> Perhaps the most compelling forensic observation is that the first vulnerable firmware was released on March 17th, 2021. From that date onward, we see stolen coins beginning to pour into the few shared addresses used by the attacker.
this is an inexcusable slop-y error that made me press close on the tab.
While no one knows if there might have have been earlier exploitation, the new exploitation just started and did not extend back to the vulnerable firmware release.
Interesting topic, but I don’t like this writing style. It’s a lot of words to say very little and repeats sentence structure often. The author assumes the reader knows about this hack already, and doesn’t not provide context on what it is, or details like why the attacker is storing coins in 4,000+ wallets.
Is there a good summary somewhere for those not already following the story?
That’s because it’s, at least partially, authored using an LLM. From experience it reads like Anthropic’s
The root cause seems to be known, unlike what this article implies. A bunch of other articles discuss the entropy issue, https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt for one I found quickly.
It's crazy how many catastrophic security bugs are just "somebody finally bothered to look".
The way AI is advancing what is growing is the ability to look far and wide.
88M is minor by crypto hack standards, and the "cost basis" of the holders on these cards started at a fraction of that, perhaps that is why nobody bothered to find this bug earlier, it's a very niche product.
Also here's a good technical writeup
https://wizardsardine.com/blog/coldcard-rng-vulnerability/
The Bitcoin communities seem to really be struggling with this hack. The people losing their coins in this case were following best practices. Typically when someone loses their coins there’s a big pile-on to victim blame them for making some mistake. I think it’s comforting to others to be able to identify a mistake someone else made and then convince yourself that you’re too smart to make the same mistake.
In this case, there isn’t much of a mistake to point out. I’ve seen a couple attempts from people trying the told-you-so routine using some arguments about multisig wallets as the only option, but mostly it looks like people are panicking and wondering if their choice of wallet has some undiscovered vulnerability waiting to be exploited. I mostly try to stay away from Bitcoin communities but in events like this it spills over everywhere. I feel sorry for anyone who lost coins, of course, but it’s also interesting to watch the communities grapple with reconciling their appreciation for irreversible key-based transactions with the realities of how this works when their money is on the line. The old ideas about having perfect OPSEC and being smarter than the other coiners are starting to get weakened with examples like this.
My guess is that the next phase is to revise history and form a consensus that Coldcard was never a recommended wallet and that it was obvious to everyone with good OPSEC at the time.
5% of btc users use a hardware wallet and Cardkite wasn't even in the top 5 MFGs as far as i'm aware.
also as far as I care the btc community members who chose to go with one of the few hardware wallets that wasn't open source were not doing due their diligence.
>My guess is that the next phase is to revise history and form a consensus that Coldcard was never a recommended wallet and that it was obvious to everyone with good OPSEC at the time.
if that's a worry just search for things far before the exploit date; lots of unhappiness around cardkite for a while now -- but to be clear, it's nowhere near a revision.
> also as far as I care the btc community members who chose to go with one of the few hardware wallets that wasn't open source were not doing due their diligence.
Seems like part of the issue here is that it was open source in a way that from the discussion here (https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt) may have made vulnerabilities easier to spot for an attacker...?
> but to be clear, it's nowhere near a revision.
That’s how the retroactive victim blaming always works: It is retroactively determined that there were signs, which turns into victim blaming anyone who didn’t predict that those signs would lead to loss of their coins.
You are doing it.
> also as far as I care the btc community members who chose to go with one of the few hardware wallets that wasn't open source were not doing due their diligence.
I can’t tell if you’re confused about the details of this story or if you’re trying to make a point that isn’t landing. You may want to read up on the open source status of the wallet before doing the whole victim blaming song and dance.
Cold wallet was definitely recommended late 2025, along with the meme of using dice to generate the entropy. Ledger wasn't recommended by coldcard definitely was
At least my dice don’t boot up with insufficient entropy
Did the dice method prevent this attack? I only skimmed about it being that the seed was mistakenly using 40 bits of entropy but I don't know at which point of the generation the bug was.
> In this case, there isn’t much of a mistake to point out.
I don’t buy this. There is no $249 device that I would trust with even 1 BTC. These folks looked at the options to preserve $100,000 and picked a $249 device over an exchange. Or a bank. Or the DOW.
It is heartbreaking the loss that some have suffered. But it doesn’t benefit anyone to say “Who could have known?” Everyone knew: because not one person said “I have verified this product and it cannot possibly be vulnerable”. So “it’s open source and you can verify it yourself!” Ok. Nobody did! “Well maybe they did, they just didn’t find the exploit” - that’s the point!
> My guess is that the next phase is to revise history and form a consensus that Coldcard was never a recommended wallet and that it was obvious to everyone with good OPSEC at the time.
Yeah. I didn’t use it. I would never use it. The problem is that “everyone with good OPSEC” are “obviously just plants of Big Bank and the IRS”. The criminals that benefit from “normal” people “legitimizing” bitcoins have really good PR department.
> I don’t buy this. There is no $249 device that I would trust with even 1 BTC. These folks looked at the options to preserve $100,000 and picked a $249 device over an exchange. Or a bank. Or the DOW.
Bitcoin communities have been advocating for hardware wallets over exchanges for a long time. The phrase goes “not your wallet, not your coins”
Yeah. It’s propaganda. It ought to be “Not your code? Not hardware you designed and built? Not your coins.” But then like ten people could safely own BTC. BTC is a criminal conspiracy that requires fools for legitimacy.
> but the fact that there are three waves in the attack shows the level of coordination and pre-planning that was involved in making it happen.
That's a strange interpretation. If it was planned well, why weren't all affected addresses drained as quickly as possible? I would have continuously emptied all vulnerable addresses, from highest to lowest without taking a break in the middle.
> Instead of picking the lowest cost option, the attacker appears to be prioritizing speed in an apparent move to make themselves as untraceable as possible.
I don't see how higher fees would make the attacker less traceable. If anything, the unusually high fees stand out. Though in the long run defenders will enumerate all the vulnerable source addresses anyway, so the affected coins are inherently traceable (at least until laundered).
More likely they prioritized speed to beat other attackers, now that the vulnerability is public. No matter if this was the original attacker or a competitor.
This is the best technical analysis I have seen, so far.
https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt
It doesn't appear that Coinkite, the company behind ColdCard products, had a mature senior engineer in the loop. At least, no engineer who could immediately flag such sloppy code commit practices. This sort of thing is ongoing, as we can see in commits made this week, even.
Clearly seems like a corporate culture issue. A very low bar seems standard practice.
I guess even when code is public nobody really reads the history very thoroughly. You'd think someone would've made stink about a company willing to show the world how they were fiddling with low-level random generation stuff with commits like `x` and `runs` in the early life of the project, without much discussion of the safety of the crypto code. We hear "don't roll your own crypto!" a lot... but in a world where there are any number of products on the market, with any number of visibility to various people, open source doesn't make all bugs shallow because there aren't anywhere near enough helpful eyeballs for most project. But probably gave some people false sense of confidence.
A few people did call out Coinkite for poor engineering at the time but it was either not seen or dismissed as hating in the context of the Coldcard/Passport fight.
Do we know how the attacker used this knowledge to access wallets? I’m not super familiar with crypto or wallets but that’s the last piece I’m missing
1. Generate all possible seeds.
2. For each seed, generate a few addresses using BIP-32.
3. Use a blockchain explorer API to check if those addresses have been used.
4. For each address that contains unspent coins, generate the corresponding private key (again using BIP-32) then create a transaction sending the coins to the attacker.
[dead]
Might have been the plan all along.
I disagree with the underlying cause claimed in that analysis: https://news.ycombinator.com/item?id=49141886
There's still some small part of me hoping that the later waves are whitehats and the reason they're keeping everything in segmented addresses is because they hope to find a way to return the funds.
how would the original owner prove ownership of the original wallet?
Don't know much about bitcoin, but if they know which numerical wallet it came from, can't send it back even if they don't know the person who owned it or communicating with that owner?
Like if I woke up one morning and found money in my bank account that wasn't supposed to be there, I could just tell the bank to send it back where it came from.
The original wallet is compromised so if you send the money back the attacker can immediately re-steal it. The original owner could try to out-RBF the attacker but game theoretically that leads to the money being converted to miner fees.
The underlying issue here is that addresses created by the tool at fault can have their private key derived from public data. If you send it back, it'll just get stolen again. Furthermore, the typical way that someone proves ownership of an address is by making a transaction from that address with parameters set via private communication with someone else. But since the private key is knowable, anyone can do that. There's no generic way to prove ownership of an address if the private key associated with that address can be determined by an attacker.
The STM32 in the ColdCard has a 96-bit UID "fused" at the factory. The lower 32 bits of this are seeded into the Yasmarang PRNG's initial state. Possession of a ColdCard with a UID matching a contested wallet might be able to serve as evidence of ownership.
Will crypto ever gain widespread adoption with constant news like this?
Or, given that previous hacks and losses didn't affect the price from shooting up to new highs, is this the perfect time to buy?
It’s one of the reasons why mainstream adoption has failed: most people lack the hubris needed to say they’ll be “smarter” than everyone else and have perfect OPSEC, run their own bank-grade security, etc. — especially since it costs more to take on those extra risks and inconvenience.
That said, there’s a lot of speculation and money laundering which provides a floor on prices. If you look at the historical numbers it looks like the whales will somewhat reliably step in around $60k to reverse a decline, which suggests there’s a benefit for some of them around that price. If you’re canny, you can probably make a decent return but I wouldn’t spend any money you can’t afford to lose.
An FDIC insured wallet would solve this, similar to bank accounts.
Low-quality post that reads like AI slop. Someone likely put three sentences into a prompt and told it to expand it into a full-length piece.
> Perhaps the most compelling forensic observation is that the first vulnerable firmware was released on March 17th, 2021. From that date onward, we see stolen coins beginning to pour into the few shared addresses used by the attacker.
this is an inexcusable slop-y error that made me press close on the tab.
While no one knows if there might have have been earlier exploitation, the new exploitation just started and did not extend back to the vulnerable firmware release.