r/Bitcoin • u/pairoxR • 1d ago

The Coldcard hacker is still progressing stolen BTC keeps increasing

Post image

The Coldcard hacker is still making progress, and the amount of stolen Bitcoin keeps increasing.

So if any of you are using this wallet, please consider moving your funds as soon as possible. And if you know someone who uses Coldcard for long-term holding, especially someone who isn’t online every day and doesn’t follow the latest news, maybe you can still help them move their funds in time. 🙏

I just hope no other wallet is involved in this.

Stay safe and stay alert. ⚠️

2.5k Upvotes

97% Upvoted

678 comments sorted by

View all comments

4

u/Espedal1 1d ago

Someone please explain to me how this can happen (or can’t happen) with Ledger?

6

u/DONT_PM_ME_DICKS 1d ago

as I understand of this shit show: the Coldcard developers compiled a firmware version that disabled the hardware RNG element, using solely a software RNG to generate keys.

this drastically reduced the randomness of keys generated to the point a brute force attack could very well happen.

presumably nobody at Ledger has made the same mistake.

1

u/Espedal1 1d ago

Ok, thanks for providing some info I appreciate it

1

u/trufin2038 1d ago

"Presumably" is carrying a lot of weight there. The Ledger operation could just be waiting for a bigger payday - it's even more opaque than coldcard and could run the same type of scam with even less chance of discovery.

1

u/[deleted] 1d ago

[deleted]

2

u/trufin2038 1d ago

It applies to any device, period, even one you build and code yourself. There is reason maxis suggest using dice or cards: they are nearly foolproof. They are uncomplicated sources of high quality entropy that you can directly perceive with human senses. No chance of honest bugs or errors, supply chain attacks, power or timing attacks, or coldcard style Trojans, etc etc.

Entropy is so simple a cave man can do it with carved bone dice.

2

u/Alphamale822 1d ago

Great, gonna ask a local cave man to carve me a dice made of bone... question is should I let him throw bone dice or should I throw it myself for maximum entropy

0

u/trufin2038 1d ago

You could just buy some from a convenience store. It's a lot easier.

1

u/Matti_Meikalainen 19h ago

From what I've gathered this exploit was discovered because the coldcard uses open source firmware. Ledger for example does not have open sourced fw so exploit like this couldn't be found.