The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M • Hacker News Board

Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M

#21

Post by fhdkweig » Sun, Aug 02, 2026, 6:27 PM UTC

nobrains wrote: post #15

smeej wrote: post #9

There's still some small part of me hoping that the later waves are whitehats and the reason they're keeping everything in segmented addresses is because they hope to find a way to return the funds.

how would the original owner prove ownership of the original wallet?

Don't know much about bitcoin, but if they know which numerical wallet it came from, can't send it back even if they don't know the person who owned it or communicating with that owner?

Like if I woke up one morning and found money in my bank account that wasn't supposed to be there, I could just tell the bank to send it back where it came from.

Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M

#22

Post by majormajor » Sun, Aug 02, 2026, 6:28 PM UTC

stblack wrote: post #7

This is the best technical analysis I have seen, so far. https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt It doesn't appear that Coinkite, the company behind ColdCard products, had a mature senior engineer in the loop. At least, no engineer who could immediately flag such sloppy code commit practices. This sort of thing is ongoing, as we can see in commits made this week, even. Clearly seems like a corpor…

I guess even when code is public nobody really reads the history very thoroughly. You'd think someone would've made stink about a company willing to show the world how they were fiddling with low-level random generation stuff with commits like `x` and `runs` in the early life of the project, without much discussion of the safety of the crypto code. We hear "don't roll your own crypto!" a lot... but in a world where there are any number of products on the market, with any number of visibility to various people, open source doesn't make all bugs shallow because there aren't anywhere near enough helpful eyeballs for most project. But probably gave some people false sense of confidence.

Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M

#23

Post by [deleted] » Sun, Aug 02, 2026, 6:28 PM UTC

soared wrote: post #14

stblack wrote: post #7

This is the best technical analysis I have seen, so far. https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt It doesn't appear that Coinkite, the company behind ColdCard products, had a mature senior engineer in the loop. At least, no engineer who could immediately flag such sloppy code commit practices. This sort of thing is ongoing, as we can see in commits made this week, even. Clearly seems like a corpor…

Do we know how the attacker used this knowledge to access wallets? I’m not super familiar with crypto or wallets but that’s the last piece I’m missing

[deleted]

Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M

#24

Post by wmf » Sun, Aug 02, 2026, 6:28 PM UTC

soared wrote: post #14

stblack wrote: post #7

This is the best technical analysis I have seen, so far. https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt It doesn't appear that Coinkite, the company behind ColdCard products, had a mature senior engineer in the loop. At least, no engineer who could immediately flag such sloppy code commit practices. This sort of thing is ongoing, as we can see in commits made this week, even. Clearly seems like a corpor…

Do we know how the attacker used this knowledge to access wallets? I’m not super familiar with crypto or wallets but that’s the last piece I’m missing

1. Generate all possible seeds.

2. For each seed, generate a few addresses using BIP-32.

3. Use a blockchain explorer API to check if those addresses have been used.

4. For each address that contains unspent coins, generate the corresponding private key (again using BIP-32) then create a transaction sending the coins to the attacker.

Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M

#25

Post by majormajor » Sun, Aug 02, 2026, 6:29 PM UTC

serf wrote: post #20

Aurornis wrote: post #3

The Bitcoin communities seem to really be struggling with this hack. The people losing their coins in this case were following best practices. Typically when someone loses their coins there’s a big pile-on to victim blame them for making some mistake. I think it’s comforting to others to be able to identify a mistake someone else made and then convince yourself that you’re too smart to make the same mistake. In this…

5% of btc users use a hardware wallet and Cardkite wasn't even in the top 5 MFGs as far as i'm aware. also as far as I care the btc community members who chose to go with one of the few hardware wallets that wasn't open source were not doing due their diligence. >My guess is that the next phase is to revise history and form a consensus that Coldcard was never a recommended wallet and that it was obvious to everyone w…

> also as far as I care the btc community members who chose to go with one of the few hardware wallets that wasn't open source were not doing due their diligence.

Seems like part of the issue here is that it was open source in a way that from the discussion here (https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt) may have made vulnerabilities easier to spot for an attacker...?

Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M

#26

Post by wmf » Sun, Aug 02, 2026, 6:33 PM UTC

majormajor wrote: post #22

stblack wrote: post #7

This is the best technical analysis I have seen, so far. https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt It doesn't appear that Coinkite, the company behind ColdCard products, had a mature senior engineer in the loop. At least, no engineer who could immediately flag such sloppy code commit practices. This sort of thing is ongoing, as we can see in commits made this week, even. Clearly seems like a corpor…

I guess even when code is public nobody really reads the history very thoroughly. You'd think someone would've made stink about a company willing to show the world how they were fiddling with low-level random generation stuff with commits like `x` and `runs` in the early life of the project, without much discussion of the safety of the crypto code. We hear "don't roll your own crypto!" a lot... but in a world where t…

A few people did call out Coinkite for poor engineering at the time but it was either not seen or dismissed as hating in the context of the Coldcard/Passport fight.

Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M

#27

Post by lowbloodsugar » Sun, Aug 02, 2026, 6:35 PM UTC

Aurornis wrote: post #3

The Bitcoin communities seem to really be struggling with this hack. The people losing their coins in this case were following best practices. Typically when someone loses their coins there’s a big pile-on to victim blame them for making some mistake. I think it’s comforting to others to be able to identify a mistake someone else made and then convince yourself that you’re too smart to make the same mistake. In this…

> In this case, there isn’t much of a mistake to point out.

I don’t buy this. There is no $249 device that I would trust with even 1 BTC. These folks looked at the options to preserve $100,000 and picked a $249 device over an exchange. Or a bank. Or the DOW.

It is heartbreaking the loss that some have suffered. But it doesn’t benefit anyone to say “Who could have known?” Everyone knew: because not one person said “I have verified this product and it cannot possibly be vulnerable”. So “it’s open source and you can verify it yourself!” Ok. Nobody did! “Well maybe they did, they just didn’t find the exploit” - that’s the point!

> My guess is that the next phase is to revise history and form a consensus that Coldcard was never a recommended wallet and that it was obvious to everyone with good OPSEC at the time.

Yeah. I didn’t use it. I would never use it. The problem is that “everyone with good OPSEC” are “obviously just plants of Big Bank and the IRS”. The criminals that benefit from “normal” people “legitimizing” bitcoins have really good PR department.

Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M

#28

Post by [deleted] » Sun, Aug 02, 2026, 6:35 PM UTC

fhdkweig wrote: post #21

nobrains wrote: post #15

Earlier quoted context omitted.

how would the original owner prove ownership of the original wallet?

Don't know much about bitcoin, but if they know which numerical wallet it came from, can't send it back even if they don't know the person who owned it or communicating with that owner? Like if I woke up one morning and found money in my bank account that wasn't supposed to be there, I could just tell the bank to send it back where it came from.

[deleted]

Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M

#29

Post by oskarw85 » Sun, Aug 02, 2026, 6:35 PM UTC

wmf wrote: post #24

soared wrote: post #14

Earlier quoted context omitted.

Do we know how the attacker used this knowledge to access wallets? I’m not super familiar with crypto or wallets but that’s the last piece I’m missing

1. Generate all possible seeds. 2. For each seed, generate a few addresses using BIP-32. 3. Use a blockchain explorer API to check if those addresses have been used. 4. For each address that contains unspent coins, generate the corresponding private key (again using BIP-32) then create a transaction sending the coins to the attacker.

[dead]

Re: The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M

#30

Post by wmf » Sun, Aug 02, 2026, 6:38 PM UTC

fhdkweig wrote: post #21

nobrains wrote: post #15

Earlier quoted context omitted.

how would the original owner prove ownership of the original wallet?

Don't know much about bitcoin, but if they know which numerical wallet it came from, can't send it back even if they don't know the person who owned it or communicating with that owner? Like if I woke up one morning and found money in my bank account that wasn't supposed to be there, I could just tell the bank to send it back where it came from.

The original wallet is compromised so if you send the money back the attacker can immediately re-steal it. The original owner could try to out-RBF the attacker but game theoretically that leads to the money being converted to miner fees.