The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M
1–10 of 44 posts
Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M
#2Will crypto ever gain widespread adoption with constant news like this?
Or, given that previous hacks and losses didn't affect the price from shooting up to new highs, is this the perfect time to buy?
Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M
#3The Bitcoin communities seem to really be struggling with this hack. The people losing their coins in this case were following best practices. Typically when someone loses their coins there’s a big pile-on to victim blame them for making some mistake. I think it’s comforting to others to be able to identify a mistake someone else made and then convince yourself that you’re too smart to make the same mistake.
In this case, there isn’t much of a mistake to point out. I’ve seen a couple attempts from people trying the told-you-so routine using some arguments about multisig wallets as the only option, but mostly it looks like people are panicking and wondering if their choice of wallet has some undiscovered vulnerability waiting to be exploited. I mostly try to stay away from Bitcoin communities but in events like this it spills over everywhere. I feel sorry for anyone who lost coins, of course, but it’s also interesting to watch the communities grapple with reconciling their appreciation for irreversible key-based transactions with the realities of how this works when their money is on the line. The old ideas about having perfect OPSEC and being smarter than the other coiners are starting to get weakened with examples like this.
My guess is that the next phase is to revise history and form a consensus that Coldcard was never a recommended wallet and that it was obvious to everyone with good OPSEC at the time.
Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M
#4> Perhaps the most compelling forensic observation is that the first vulnerable firmware was released on March 17th, 2021. From that date onward, we see stolen coins beginning to pour into the few shared addresses used by the attacker.
this is an inexcusable slop-y error that made me press close on the tab.
While no one knows if there might have have been earlier exploitation, the new exploitation just started and did not extend back to the vulnerable firmware release.
Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M
#5The root cause seems to be known, unlike what this article implies. A bunch of other articles discuss the entropy issue, https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt for one I found quickly.
Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M
#6Interesting topic, but I don’t like this writing style. It’s a lot of words to say very little and repeats sentence structure often. The author assumes the reader knows about this hack already, and doesn’t not provide context on what it is, or details like why the attacker is storing coins in 4,000+ wallets.
Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M
#7This is the best technical analysis I have seen, so far.
https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt
It doesn't appear that Coinkite, the company behind ColdCard products, had a mature senior engineer in the loop. At least, no engineer who could immediately flag such sloppy code commit practices. This sort of thing is ongoing, as we can see in commits made this week, even.
Clearly seems like a corporate culture issue. A very low bar seems standard practice.
Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M
#8Will crypto ever gain widespread adoption with constant news like this? Or, given that previous hacks and losses didn't affect the price from shooting up to new highs, is this the perfect time to buy?
An FDIC insured wallet would solve this, similar to bank accounts.
Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M
#9There's still some small part of me hoping that the later waves are whitehats and the reason they're keeping everything in segmented addresses is because they hope to find a way to return the funds.
Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M
#10Will crypto ever gain widespread adoption with constant news like this? Or, given that previous hacks and losses didn't affect the price from shooting up to new highs, is this the perfect time to buy?
It’s one of the reasons why mainstream adoption has failed: most people lack the hubris needed to say they’ll be “smarter” than everyone else and have perfect OPSEC, run their own bank-grade security, etc. — especially since it costs more to take on those extra risks and inconvenience.
That said, there’s a lot of speculation and money laundering which provides a floor on prices. If you look at the historical numbers it looks like the whales will somewhat reliably step in around $60k to reverse a decline, which suggests there’s a benefit for some of them around that price. If you’re canny, you can probably make a decent return but I wouldn’t spend any money you can’t afford to lose.