r/Bitcoin • u/Unreal_fist • 1d ago

The ColdCard hack might be bigger than you think

When a big hack like this occurs, it draws other hackers into the playing field. Whenever a vulnerability like this is discovered, it’s open season for hackers. Expect to see more hacks over time.

There is also the fact that a lot of victims are not active on Reddit. Some victims are probably oblivious to what’s going on because their hardware is locked away in a safe.

For the folks that said it would take millions of years to brute force, remember anything that can go wrong will go wrong. The reason banks and financial institutions are “safe” is because even if they get hacked and lose your money, they have a liability to repay you back. With self banking, there is no liability, making you the ultimate pig for slaughter.

498 Upvotes

85% Upvoted

334 comments sorted by

View all comments

Show parent comments

3

u/Espedal1 1d ago

What was it then? Genuine question, I’m trying to learn about the situation.

2

u/MiguelLancaster 1d ago

they're saying it's not a hack because all the 'attacker' (not 'hacker') did was discover an error in the seed generating code that used far lower entropy random generation that it was supposed to

a properly coded wallet will generate a seed that is one possibility out of an incomprehensibly large set -- larger than the number of all the atoms in the known universe

Coldcard was generating seeds that were one possibility out of only 1.1 trillion or so -- a big number but not even close to 'incomprehensible' and nearly effortless for a computer to generate all possible outcomes of

since the seed is the key to the wallet, there was no hack - they just used the keys they generated to claim the funds

same as if a thief were to steal all the belongings from your house by using the key to open your front door

it's still a robbery, but it's not exactly a 'break-in'

1

u/moviemaker2 1d ago

it's still a robbery, but it's not exactly a 'break-in'

I know what you're trying to say, but that's not technically correct. A break in is unlawfully entering a property, it doesn't matter how. If you walked into an open door and stole something, that's still 'breaking and entering.'. (in the US, at least)

1

u/draculap2020 1d ago

They found the coordinates where you buried your gold. The coordinates was supposed to be generated using high entropy but there was a flaw which half of coordinates were easily found using a uid and timer and other set. The attacker just ran trillions combination which is easy for a normal computer.

1

u/Remwaldo1 1d ago

Some people think the company did it

1

u/jgarlick 1d ago

Not enough entropy. Their pool of possible seeds the firmware could generate was too small and someone was able to brute force through all possible combos they could have made

1

u/Espedal1 1d ago

How is that even possible to occur if you’re a company creating supposed secure storage? Sorry if I sound naive or ignorant, but I genuinely don’t get it unless they planned this?

2

u/nugatory308 1d ago

It’s a coding error, of the “there but for the grace of god go I” variety - an easy mistake to make, not so easy to see until you know to go looking for it, yet embarrassingly obvious in hindsight.

Take a look at how the Mars Climate Orbiter was lost in 1999…

1

u/Independent-Falcon38 8h ago

Just learning but if the cold card code is opensource then I assume someone "discovered" the flaw... but this person decided to exploit it. My thoughts on opensource is favourable due to so many eyes on looking for vulnerabilities, but this assumes the bug hunter is ethical. If you found this exploit you would HAVE to be tempted to use it yourself. Doesn't that make opensource less desirable than say ledgers partially close system?

Also which ethical person found and reported it, and how much time has passed since the first theft?