This Isn't the End of Bitcoin Self Custody
On the Coldcard Firmware Vulnerability and Resulting Hack of Funds
This week, the worst event in the history of Bitcoin self custody transpired.
Due to a critical vulnerability in firmware 4.0.1, released in March 2021, through firmware 4.1.9, which Coldcard users have been running up until now, the 12-to-24-word seed phrases that the device produced for users were insecure.
This has resulted in the private keys for over 4,5000 addresses being exposed (found with the help of AI) and $89 million worth of bitcoin having been stolen from users thus far.
Users of the Coldcard Mk3 have been primarily affected.
If you are using a Coldcard Mk3 especially, or any Coldcard device that generated your 12-to-24-word seed phrase for you, please stop reading this now and transfer your funds either to another wallet through which you set up a new private key or to an exchange or third party that you trust.
DON’T INPUT THE PRIVATE KEY THAT COLDCARD GENERATED FOR YOU VIA YOUR COLDCARD DEVICE INTO A NEW DEVICE. THAT KEY IS LIKELY COMPROMISED.
Wallets To Which You Can Move Your Funds
As far as wallets you might want to use, I humbly recommend Trezor if you’re looking to transfer directly to another hardware wallet and Sparrow Wallet, the Bull Bitcoin wallet or Muun Wallet, all of which are software wallets (Sparrow can also be used as an interface for hardware wallets), if you don’t have a Trezor handy and need to move your funds ASAP.
Exchanges/Third Parties to Which You Can Move Your Funds
As far as exchanges or third parties, the two best options right now, in my humble opinion, are River and AnchorWatch (they’re offering high-level custody cost-free for 60 days). With that said, you’re better off transferring your bitcoin to any exchange that you’ve used and that you trust than leaving it vulnerable via your Coldcard-generated private keys.
Multisig Setups to Which You Can Move Your Funds
If you are ready to move your funds into a multisig setup, I highly recommend using Casa to do so. I’ll share more on the service Casa provides further down, but if you’re already familiar with them and just need to pull the trigger on opening an account, please feel free to use my promo code at checkout for a discount: 32b7ae06
Unchained is also another reputable company that can help you establish a multisig setup.
What Caused This Issue with Coldcard?
A Coldcard firmware bug — one line of bad code, to be more precise — caused a bypass of Coldcard’s Random Number Generator (RNG), which led to the device providing its users with private keys that were easily guessable.
TO BE CLEAR, THIS ISSUE IS WITH COLDCARD AND NOT THE BITCOIN NETWORK ITSELF. THE BITCOIN NETWORK IS STILL SECURE.
Because of improper coding — and then no one properly auditing said code for five years — the Coldcard device created private that LLMs (AI) could determine with relative ease.
More on the lackadaisical auditing here:
And more on just how insecure the seed phrases that Coldcard was generating were here:
The flawed line of code essentially had Coldcard bypass using a proper RNG and defaulted to it using an RNG that provided much less secure private key.
For those who are more technical, here’s a breakdown from Kimi K3, the most advanced open-source LLM yet and the same model that was used to find the Coldcard firmware vulnerability, on what happened:
The root cause was an RNG integration/build-configuration bug, not a broken algorithm.
Coldcard’s board config set
MICROPY_HW_ENABLE_RNGto0, intending to bypass MicroPython’s RNG and use Coinkite’s own hardware-RNG wrapper. But libngu checked that macro with#ifndef MICROPY_HW_ENABLE_RNG—i.e. “is it defined?”—rather than “is it nonzero?”. Since the macro was defined as0, the build did not fail, andngu.randomended up binding to MicroPython’s deterministicrng_get()fallback.That fallback was a Yasmarang software PRNG seeded from non-cryptographic device/timing values such as the MCU UID, SysTick, and RTC. Once those values and the RNG call history are known or constrained, the output stream is reproducible. XORing it with another Yasmarang instance initialized from public constants did not add entropy, and later hashing the 32-byte output could not increase the number of possible seeds.
For Mk4/Q/Mk5, boot code did pull randomness from the secure elements, but then threw most of it away: it hashed the SE output, kept only the first 4 bytes, and called
ngu.random.reseed()with a single 32-bit integer. That reseed only replaced one 32-bit Yasmarang state word and did not reset the full state or instantiate a cryptographic DRBG, leaving at most about 232232 securely distinguished streams under Block’s analysis; Coinkite’s advisory described affected Mk4/Q/Mk5 seeds as roughly 72-bit rather than the expected 128-bit.Impact depended on the firmware used when the secret was generated:
Mk2/Mk3 firmware v4.0.0–v4.1.9: vulnerable deterministic path.
Mk4/Q/Mk5 before the fixed releases: fallback path plus only a 32-bit reseed.
Mk1 and Mk2/Mk3 through v3.2.2: not in this regression.
Paper-wallet/secp256k1 keys were especially exposed because random bytes were used directly as the private key, with no BIP39/BIP32 expansion; “Use Dice” bypassed this RNG path.
The fix was to exclude MicroPython’s fallback PRNG object and add a build-time check that fails unless the board-specific code provides the real global
rng_get()symbol. Any seed or exported key created while on vulnerable firmware should be treated as suspect and funds moved to a newly generated wallet on fixed firmware.
When you create a bitcoin private key, you want it to be a very long string of letters and numbers (which comes in the form of 12-to-24 words) — something that would take a nearly infinite amount of years for any amount of computers to guess.
The longer and more complex the string of letters and numbers, the more entropy it has.
What Is Entropy?
Generally speaking, entropy is a degree of randomness and disorder.
As it pertains to Bitcoin wallets, entropy is a long, raw, and very random number or combination of numbers and letters that’s practically impossible to guess.
The chart below is the best example I’ve found of how entropy works. (“Brute force” means using a trial and error approach with a powerful computer to attempt to determine someone’s private key.)
Regarding Bitcoin wallets, the safest way to generate your own entropy is to roll a die or a bunch of dice 100 times and then input the results of those dice rolls into wallets that enable this sort of seed generation approach.
Said wallets include Keystone, SeedSigner (I really like this wallet), BitBox, and Coldcard.
Because I used the dice roll method to create my seed for my Coldcard wallet, I was immune to the hack that just took place.
And if I’m being fully transparent, I’ll admit that I felt like a bit of a tin foil hat wearer as I rolled these dice to generate the seed, but, now, I couldn’t be happier that I did.
To get a better idea of how the dice rolls work, I highly recommend watching this tutorial and/or the video below:
Why I’ve Never Recommended Coldcard or Dice Rolls
You may be asking yourself why I’ve never recommended Coldcard if I use it or why I’ve never recommended dice rolls to create your seed if I’ve done it.
These are fair questions to ask.
Regarding Coldcard, I’ve always felt that it’s too difficult to use for those who are new to Bitcoin or for average Bitcoin users — the people I aim to reach through my writing.
I’d often have to go back and watch tutorials every time I used it just to make sure I was doing everything correctly.
As far as seed generation, I believe that using a Trezor device to generate a seed phrase for you is the best way for the average, non-technical user to generate their seed.
I say this because 1.) Trezor’s code is fully open-source, which means it can be audited and 2.) Trezor created the first ever Bitcoin wallet and they have a 13-year track record of creating trustworthy products.
I’m beginning to reconsider my stance here because Coldcard was fully open-source, and we’ve just seen that even that didn’t stop what has transpired. I will share more on where I land on this in future editions of this newsletter.
That said, in a recent Kimi K3-facilitated audit of popular Bitcoin wallets, Trezor Safe 3, 5, and 7 scored amongst the safest wallets in the Bitcoin space.
For this reason, I still recommend the Trezor Safe 3 for beginners.
If you feel comfortable rolling dice to generate your seed phrase, then I recommend the SeedSigner devices.
NVK’s Hubris
There’s also another reason I’ve never recommended Coldcard, and that is that one of the co-founders of Coldcard, Rodolfo Novak (who goes by NVK), has quite an ego.
He’s often been quick to put down other projects and to take great pride in creating what has often been referred to as the gold standard in bitcoin self custody with Coldcard.
There were also rumors that he blocked reputable projects like SeedSigner from receiving development grants from OpenSats, a non-profit that provides grants to Bitcoin developers that he sits on the board of.
I’m always hesitant to trust people with big egos.
Those who think they can often do no wrong often fall the hardest.
And fall the hardest NVK has, as, again, this is the absolute worst situation we’ve ever seen in the world of Bitcoin self custody.
With that said, I don’t share this to encourage people to pile on and cheer for the demise of NVK.
I’d imagine he’s in enough pain and will be in this sort of pain for the foreseeable future.
I share this more because this is a very good reminder to 1.) keep our own egos at bay and to constantly reflect on how imperfect and fallible we all are and 2.) to do our best to eliminate single points of failure as it pertains to protecting our bitcoin.
Below is one way to do the latter.
Use a Multi-Vendor Multisig Like Casa or Unchained
Man, does “multi-vendor multisig” sound intimidating.
Let me explain what it means.
First of all, “multisig” is short for “multisignature”.
When we make a Bitcoin transaction, we sign the transaction. When you send bitcoin with a Trezor or a Coldcard, you sign a transaction to send bitcoin using the hardware device.
The potential issue here is that if your private key is compromised, like what we’re seeing with this Coldcard hack, anyone with that key can send all of the bitcoin from your wallet to theirs.
With a multisignature set up, you have to sign a transaction with two different wallets (signing devices). This means that even if the key for one of your wallets is compromised, a hacker still can’t move your bitcoin because they would need the other key to do so, as well.
Multi-vendor means you use wallets that were created from different companies. For example, in a multisignature set up, you could use a Trezor device, a Seedsigner device, and the Bull Bitcoin wallet.
This way, if one company makes an error like Coldcard did, you are still safe because the hackers only have one of the two (or more) keys that they need to sign.
To this point, if you are currently using two Coldcards in your multisig setup and the Coldcard devices created the seeds for both (as opposed to dice rolls), your funds are at risk. Move them now.
With multisignature wallets, only a certain numbers of wallets within the signature scheme need to sign to move a transaction.
The most common setups are schemes with three wallets where two need to sign or those with five wallets where three need to sign.
Setting up these types of wallets on your own can be nerve-racking. Using a company to help you do it is much easier. The difference between the two is that doing it on your own is free while doing it via a company costs money.
If you do this on your own, the best wallet to use IMHO is Sparrow. My only advice here is “proceed with caution.” I don’t want to tell people not to set these up on their own, because that means I don’t believe people can. I’ll just say it’s more difficult than setting up a single-signature hardware wallet and leave it at that.
If you like the idea of a multisig wallet and you have some extra discretionary income, I recommend either Casa or Unchained. I actually recommended Casa more so than Unchained, but they’re both good.
With both Casa and Unchained, the company holds one of your keys. This means that if you lose one of your keys, you can rely on Casa to co-sign a transaction with you, while, as the same time, they can never move any of your bitcoin on their own with just the one key that they hold.
If you’d like to get started with Casa at a discount, please use my promo code at checkout: 32b7ae06
This Isn’t the End of Self Custody — It’s Just a Setback
I know that news like that of this Coldcard hack can rattle one’s insides.
It’s deeply unnerving to put it mildly, and it’s extremely saddening to think of all of the people who have lost funds, some of whom who have lost their life savings.
Despite this profound and disheartening setback, I still do believe wholeheartedly in self custody when it comes to Bitcoin.
Without it, Bitcoin fails.
People need to hold their own bitcoin and to use it for the system to remain decentralized and secure.
Coldcard made a brutal mistake here, one that I’m sure will cause some people to give up on Bitcoin, at least temporarily.
I wish I could promise that other companies won’t make similar mistakes, but I can’t.
What I can say, though, is that in the age of AI, companies and developers have more power than ever when it comes to auditing their code for errors like the one that Coldcard made. To me, this is promising.
I can also say that there are ways to protect yourself from errors that others might make, like generating your own seed phrase with dice rolls and using a multi-vendor multisig set up.
To anyone out there reading this who was affected by the hack, my heart goes out to you.
To everyone else, please treat this like a wake up call as opposed to a reason to abandon Bitcoin.
Finally, I know a lot of this information may have been confusing, so please click the orange button below and leave any questions you may have in the comments. I will make time to answer as many of them as I can.
Finally, please share this with family, friends, and anyone else you think may have been affected by this hack, and thank you for reading.
Best,
Frank
You can also use Bull as an interface to a hardware wallet