The COLDCARD Hack Was Bitcoin’s 9/11

Coldcard, I guess just to give the background, Coldcard, a hardware wallet by CoinKite, which is a Bitcoin hardware wallet.

There was a bug in the wallet seed phrase generation process.

that reduced the effective entropy of the seed phrase from, it should have been a minimum of 128 bits.

It reduced it down to, I believe it was like 40, 40 bits, 40 and 50 bits in some cases.

And in other cases, it reduced it to 70 bits.

70 bits, both of which are within the realm of just being brute forced, just trying a bunch of possibilities on a fast computer and seeing if you can recover somebody's seed phrase.

This bug was, this was a longstanding bug that was introduced, I think 2021 or 2022.

In 2021 with the Mark III in the, I don't even want to speculate, 3.3.0 firmware.

No, it

was the 4.1. That's when it was

introduced.

4.0.0 firmware.

Nobody knew about it for a long time, as far as we know.

And the nature of this bug was such that when you generated your seed phrase, it looked like a normal seed phrase.

You can't tell how much entropy went into a seed phrase.

And... your coins were safe up until somebody found the bug a few weeks ago, one week ago, and started exploiting it and stealing people's coins.

Well, who knows when actually they must have found it before, because basically the way that the bug works is so the bug results in, as Casey said, these low entropy seed phrases.

But then it takes a long time to actually brute force it.

No, no,

low, low entropy seed phrase doesn't take a long time.

I think you would you would go would be pretty brief.

How long? Because the reason why I say it is because the hack happened on Thursday morning, something like that, Thursday, July 30th, I think.

But how long in advance would the hacker had to have brute force the seed phrases that they hacked?

I wish I knew, but I think it's very difficult to say because it depends on the sophistication of

it.