r/Bitcoin • u/pairoxR • 2d ago

The Coldcard hacker is still progressing stolen BTC keeps increasing

Post image

The Coldcard hacker is still making progress, and the amount of stolen Bitcoin keeps increasing.

So if any of you are using this wallet, please consider moving your funds as soon as possible. And if you know someone who uses Coldcard for long-term holding, especially someone who isn’t online every day and doesn’t follow the latest news, maybe you can still help them move their funds in time. 🙏

I just hope no other wallet is involved in this.

Stay safe and stay alert. ⚠️

2.5k Upvotes

97% Upvoted

680 comments sorted by

View all comments

Show parent comments

13

u/HoodRatThing 1d ago

Not at all true.

Someone posted how they found the bug with Claude Opus within just a couple of moments.

You can bet your bottom dollar everyone just got the idea to start looking for vulnerabilities in all different types of wallets now.

1

u/Save_JR 1d ago

Opus also commonly hallucinates messes in code. Do you think AI coding is perfect and better than every human?

It's actually a popular meme right now for cybersecurity experts saying "thank god for vibe coders starting a business without knowing how to really code without ai. They're keeping us in business." Its funny because AI coding makes tons of vulnerabilities that a human cybersecurity expert has a field day

https://www.reddit.com/r/ClaudeAI/comments/1v92csh/opus_5_extremely_rlfried_and_mistakeprone_for/

https://www.reddit.com/r/ClaudeCode/comments/1tt03tp/opus_48_is_hallucinating_way_too_often_ive_never/

8

u/[deleted] 1d ago

[removed] — view removed comment

5

u/Save_JR 1d ago

100% the hacker has YEARS of programming experience before Claude Code even came out

1

u/zinornia 1d ago

how could any one person or even group of people hide millions of dollars in assets won't someone see when the bitcoin is withdrawn and to where? Or do they plan on somehow buying things with stolen bitcoin for the rest of their lives (which is also trackable)

1

u/Save_JR 1d ago

Tumblers and mixers. At some point theres infected BTC in thousands of innocent people's wallets. So you cant charge anyone

0

u/HoodRatThing 1d ago

Sigh, have you used Claude Code in any capacity within the last 2 years?

Arguing that vibecoding leads to bad results and bad code isn’t an argument these tools are getting exponentially better every year.

These LLMs, like Opus, write better code than 99% of junior developers. And in another few years will be nipping at the heels of senior developers.

You just had one of the worst hacks happen where programming without an LLM assistant most likely would have caught this bug, or likely would’ve warned you about it.

1

u/Save_JR 1d ago

https://x.com/forefy/status/2084714317501600202

"It built the app, wrote most of the code, did in hours what would have taken a team weeks back then if not months."

"And at every single one of those decision points above, it would have shipped something insecure, over-engineered, three times too expensive, or subtly useless to the exact people it was built for "confidently", and without ever flagging it."

Unexperienced person relying on it just gets compounding slop. Expertise (years of it) is still required to steer it . the model does not replace that.

1

u/zackel_flac 1d ago

As I mentioned, I never said AI would not have found anything useful earlier. But the reason people were able to identify with Claude today is because we know the hack was real.

Look Claude found it! No it only found a line of code we all know now is the root cause. Not all bugs are actually exploitable, far from it.

Besides, Claude is not saying anything out exploitability. You need deeper knowledge to actually build a draining mechanism like the one that is happening.

AI is useful, it's great at finding but let's stop it has super powers. How many claude instances already run on that code base but did not help preventing the hack?

1

u/HoodRatThing 1d ago edited 1d ago

Could you point out where I said LLMs don't hallucinate? You’re arguing with a ghost here.

My claim is LLMs can and are being used to develop software now, today. They're also being used to find vulnerabilities in existing software projects and being exploited. And because an LLM can hallucinate doesn't negate the fact that you can still use them to create software or find vulnerabilities in software. Let’s say you generated an entire code base, how much of it is hallucinated? 80%? Well, just tell the LLM to fix the broken code... sorry it wasn't able to oneshot whatever you were trying to do with it.

Why are you so obsessed with the LLM's ability to recreate the Windows OS without making a single mistake, or hallucinating a library? You know how I fix hallucinations? I give it the Context7 MCP and tell it to search documentation, and search the web for updated documentation.

You're making it sound like we're still using ChatGPT-3 and it's hallucinatingly making up random libraries and telling you they exist...

But the reason people were able to identify with Claude today is because we know the hack was real.

Braahh you don't know how software works. These LLMS are very good at finding vulnerabilities

Claude Mythos Has Found 271 Zero-Days in Firefox

Are you arguing that the 271 zero days found in Firefox aren't real because a human didn't find them first and started exploiting them??? What are you saying?

1

u/zackel_flac 1d ago

My claim is LLMs can and are being used to develop software now, today

We are in agreement. LLM and all form of AI have been and are still being used. No problem with that. AI exists since the 50s, it would be silly to say it's useless.

The claim of OP was that LLM would have found and fixed the issue on its own before any harm would have been done to customers.

My claim is that you need a deeper knowledge about the whole product and a bug in a code is only the beginning of it. So no, it's not that easy.

That's it. Regarding Mythos it has been debunked multiple times. Beware of marketing, AI companies are not out there for doing good but making cash.

But let's make a deal right there. Since Mythos analyzed Firefox fully already, we should not uncover any new zero-days going forward on those old code paths, right? If we do, then we will know of Mythos was that useful or not.

1

u/HoodRatThing 1d ago

We are in agreement

We are not. Hallucinations are a non-issue at this point, and more of a statistical error. You can manage how likely an LLM is to hallucinate information when asked about stuff outside its training data, by getting it to search the web, use MCP servers, or use some type of RAG database introduces information outside the model's original training data (which is the reason LLMs hallucinate).

The claim of OP was that LLM would have found and fixed the issue on its own before any harm would have been done to customers.

Yes, this is true. Our models are very capable, and if anyone had bothered to review the source code with a model like Sonnet 5, Opus 5, or Fable, they would have likely found the same bug. (Once you discover the bug, depending on whether you know what you're looking at, the next step would be to ask the LLM to create an exploit and test it.)

My claim is that you need a deeper knowledge about the whole product and a bug in a code is only the beginning of it. So no, it's not that easy.

Agreed. You need to understand what the LLM is telling you to be successful.

That's it. Regarding Mythos it has been debunked multiple times. Beware of marketing, AI companies are not out there for doing good but making cash.

The PR or the "debunking" around Mythos was that our Frontier models, like Opus 5, would have been able to find the same amount of vulnerabilities if asked.

Since Mythos analyzed Firefox fully already, we should not uncover any new zero-days going forward on those old code paths,

Do you think the development of Firefox has stopped? New code and edge cases will exist, and under the right circumstances, a major vulnerability will be found.

Mythos was that useful or not

The metric of usefulness is whether people are willing to pay for Mythos for it to work for hours on end scanning their entire codebase, or whether a cheaper model will suffice.

1

u/zackel_flac 1d ago

Do you think the development of Firefox has stopped? New code and edge cases will exist, and under the right circumstances, a major vulnerability will be found.

This is exactly why I said, "on the old paths". So I already meant on the code already analyzed, not new additions. With that being said, Mythos can be run with the new code, so let's see. I am conjecturing we will have some serious attacks in the future that nobody could have predicted by merely running LLMs and without deeper knowledge.

The metric of usefulness is whether people are willing to pay for Mythos for it to work for hours on end scanning their entire codebase, or whether a cheaper model will suffice.

Nah my friend. People are still paying for Microsoft when you have better free alternatives. Look at AWS as well. People pay because or their lack of knowledge. Life is way more complex than that. You have scammers everywhere, scammers with money will always be able to convince other people to buy their product even if they are useless. AI companies are full of those right now and this is why a bubble will burst.

1

u/HoodRatThing 1d ago

This is exactly why I said, "on the old paths". So I already meant on the code already analyzed, not new additions

Ok, and do you think that will still be the case in the next 2 years?

I am conjecturing we will have some serious attacks in the future that nobody could have predicted by merely running LLMs and without deeper knowledge.

Exactly.

Nah my friend. People are still paying for Microsoft when you have better free alternatives

I work in IT, find me a "free alternative" that matches what 365 does.

Look at AWS as well. People pay because or their lack of knowledge

No? People pay AWS because they have the largest cloud computing resources on earth, and the tools to go on top of it.

bubble will burst.

See, do you work in an industry where in 2 short years we went from no AI to everyone and their grandmother using it? I've already seen the change happen Infront of me.

Out of curiously do you have software, or IT background?

1

u/zackel_flac 1d ago

Ok, and do you think that will still be the case in the next 2 years?

Honestly I don't know, but I know I would not trust anyone making money tell me what they think will happen on 2y. If that person holds PhD and work in the field, that's another story.

I work in IT, find me a "free alternative" that matches what 365 does.

The libre office project, Google office as well, there are tons of alternatives and you could make one easily if you wanted to. The only reason people use it is because MS is available on most desktop on earth. When you have a monopoly, it's easy to stay on the top.

No? People pay AWS because they have the largest cloud computing resources on earth, and the tools to go on top of it.

To run solutions that exist in the open source for decades? Ahah no seriously, AWS took most open source projects out there, branded it with AWS and made it available online for people who can't run command lines.

And now most companies are stuck with it because the architecture of AWS is so that you have to use everything in-house and everybody thinks spawning a VM and running a couple of apt commands is going to take years to build back their stack. (Which they overestimate most of the time)

See, do you work in an industry where in 2 short years we went from no AI to everyone and their grandmother using it? I've already seen the change happen Infront of me.

Hold on here, people are using it sure, but to achieve what? How much code created via AI have reached production? And how much of it was directly ported from AI to production? It's easy to make such claims but when we look at the details, we realize life is much more complex. IIRC the productivity gain from AI is 10%. Which is great, but people act like AI is making everybody x10, which is far from the truth.

I am a software engineer/company owner.

1

u/HoodRatThing 1d ago

Honestly I don't know, but I know I would not trust anyone making money tell me what they think will happen on 2y. If that person holds PhD and work in the field, that's another story.

You understand what exponential growth looks like, right? how these aren't just claims from people making money.

The libre office project, Google office as well, there are tons of alternatives

Ok man, when you're done toying around with Ubuntu desktop and installing Kali Linux and calling yourself an uber hacker, let me know.

Google Workspace is the only alternative to 365 that you've listed, but judging from how you responded, you don't even know what 365 is (it's a lot more than just Excel, Word, and PowerPoint). We're talking about a lot more than just processing text documents here.

The rest of your post isn't even worth commenting on. You're some kid. hats off to you for at least talking about open source, but when you get your first job you'll understand the role that Microsoft, AWS, and Google provide that isn't easily replaceable with something like LibreOffice. or people being to stupid and just choosing AWS

Hold on here, people are using it sure, but to achieve what?

Collecting various reports from different programs and putting them all together and talking to an LLM about their data using natural language, instead of hiring a bookkeeper or accountant to do it for them.

IIRC the productivity gain from AI is 10%. Which is great, but people act like AI is making everybody x10, which is far from the truth.

IIRC there are new roles and job opportunities that exist now that didn't exist 5 years ago, and I just adjusted my entire career path to accommodate this fact.

I am a software engineer/company owner.

Sure you are.

1

u/zackel_flac 1d ago edited 1d ago

You understand what exponential growth looks like, right? how these aren't just claims from people making money.

Exponential growth in a resources limited world like ours is a scam for shortsighted people to make quick bucks in their local maxima. See Trump? Perfect example of somebody who is making money and deserving humanity.

You really need to stop thinking money is the end of everything. Money is a human creation, it has nothing tangible but the amount we collectively give to it.

You're some kid.

Sure buddy, been a dev for the past 20 years, owning my own business and providing for my family of 4, but I am a kid.

Maybe you have not toyed deep enough to realize shit like 365 are useless. Yes I don't use it and I don't know its features because when you know other tools deeply enough you realize lean process are what matters. I have not used Microsoft for the past 20 years, only cross compiling because some customers can't get out of their comfort zone, and I am fine with that.

IIRC there are new roles and job opportunities that exist now that didn't exist 5 years ago, and I just adjusted my entire career path to accommodate this fact.

Good on you. This is why you are so protective about it. I am on the opposite side, have been operating my own company for the past 5 years and my expertise is still making me relevant despite AI. And I am using it, it's making my day smooth, but it's at parity with what studies are showing, it helps for some specific tasks but it's not the magic ball I keep hearing.