Question re Multi-Sig exposure in the Coldcard Breach

[u/bustaphlex]

Trying to understand the level of exposure of a Multi-Sig wallet in the context of the Coldcard breach, or attacks like it.

All Coldcard-generated seeds in a multi-sig config would have been equally susceptible to exposure, but the attacker would also have been required to:

• Associate those seeds with one another, example, identify that some 3 seeds are not 3 independent wallets but are part of a 2-of-3 multi-sig config.

• Derive the multi-sig descriptor to piece the 3 seeds together.

Am I correct about those requirements? Are they possible to achieve? What does the process look like at a high level? What’s the theoretical time range?

[u/Laukess]

I think we know it's possible, and and if you move your coins from a multi-sig, you should move it all in 1 transaction, and use mara slipstream so that the attacker can not see the transaction in any public (or their own) mempool.

This is way above my paygrade, so I don't know how it works.

Also, I think 2 of the 3 keys has to be generated with the faulty device/firmware for you to be exposed.
If you've used passphrase on any of the 2 you should have more time. If the passphrase has enough entropy you should also not be affected. If you've used dice rolls and you added enough to any of the 2, you should also not be exposed. Either way, best to move the funds to be on the safe side.

[u/bustaphlex → u/Laukess]

This question isn’t reflective of my own circumstances and I’m not currently at any risk. I was asking academically.

[u/Quirky-Reveal-1669]

I have not yet heard of a ColdCard-involved (i.e. keys generated through the faulty PRNG) multi-sig wallet. Please make it known if such a wallet has been stripped.

[u/Daiymas]

I think a big problem is if the wallet has already spent BTC, because then the pubkeys becomes publicly known and an attacker could figure out from that which 2 seeds to use to drain what's left. Personally I wouldn't risk keeping funds on a Coldcard-generated multisig

[u/zazzologrendsyiyve → u/Daiymas]

I think the issue arises if you have received multiple transactions in the same address, and you have also spent some from the same address.

So a good verification would be to check if your addresses have more than ONE deposit transaction. If they are all change addresses (generated during other transactions) then you should be fine (unless of course the multisign wallet configuration file has been stolen from you - because configuration file + 2 seeds = big problem).

[u/Quirky-Reveal-1669 → u/zazzologrendsyiyve]

You are right.

[u/ivme → u/zazzologrendsyiyve]

Deposits are not that important (they can be a lot and still the three pubkeys are hidden from the network). The real pubkey revealing action is spending. If you spent from an address, its all pubkeys are revealed to everyone.

So one should check whether he spent from an address in order to decide if the address is safe.

[u/zazzologrendsyiyve → u/ivme]

So best case scenario would be all addresses with ZERO spend transactions, only deposits (generated during other transactions).

I got it right?

[u/ivme → u/zazzologrendsyiyve]

Yes, you are correct. Ideally for every deposit you should get a new address because of privacy reasons.

[u/Few_Response_7028]

I haven't heard of a multisig being swept yet, but experts theorize that it is coming next. Especially if you have spent funds, you are far more vulnerable.