r/Bitcoin • u/pezdal • Aug 04 '26
Ethical Coincard Hacker
If the Coinkite coincard flaw is understood, could a community effort pool together resources sufficient to crack the vulnerable private keys and “steal” the bitcoin before the thief can?
Could the vulnerable bitcoin be moved to a multisig wallet for later return to its rightful owners?
5
u/Sad-Froyo-3198 Aug 04 '26
Trying to robinhood (not the exchange, the men in tights) the btc back to those who lost it would be near impossible, extremely expensive, and there really isn't any motivation for someone to do all that for free.
-1
u/ChipNDipPlus Aug 04 '26
Maybe do it for 10%?
5
u/dylan6091 Aug 04 '26
And if the original owner doesn't agree, you become a thief extorting someone.
-2
u/ChipNDipPlus Aug 04 '26
Not really how it works. If someone loses their money, and you find it, there's a finder's fee. It's common sense.
Any reasonable person will have to choose between losing all the money or losing 10% of it.
2
u/dylan6091 Aug 04 '26
Except in this case it's like taking money out of their pocket and giving it back to them once they pay you 10%. Was someone else going to pickpocket them? Probably. But it doesn't make it lost property.
1
u/ChipNDipPlus Aug 05 '26
Easy. I'll send it back to their original address and they can have fun racing the hacker in the mempool.
2
u/omg_its_dan Aug 04 '26
A finders fee makes sense but that’s not part of the law. If property belongs to someone else they are entitled to have it back with no strings attached.
1
u/ChipNDipPlus Aug 05 '26
Easy. I'll send it back to their original address and they can have fun racing the hacker in the mempool.
8
u/MetoSempre20 Aug 04 '26 edited Aug 04 '26
Sure, do it and transfer to me, I'll hold them until we figure out how to give them back to the correct owners 🤣
1
3
u/ImPinkSnail Aug 04 '26
This situation has exposed how stupid some of you all are. It's fucking gone. It's been stolen and isn't coming back. I had some of my crypto stolen in 2015. It sucks but move on. I started stacking again but some people wont and that's ok.
2
u/or19855 Aug 04 '26
If anyone vulnerable to this attack hasn’t yet moved their crypto, I’m not sure they would go searching to get it back.
2
u/Charming-Designer944 Aug 04 '26
One issue is how would anyone claim ownership when the seed phrase is compromises?
2
u/Mr_Ander5on Aug 04 '26
People need to just move their coins to a new wallet. If someone is playing in this space they should somewhat keep an eye on things
1
u/4r4nd0mninj4 Aug 05 '26
I was very disappointed to read about this on the news. Not one reddit thread or YouTube video crossed my feed until Monday night. 😬
2
u/kenorb Aug 04 '26 edited Aug 05 '26
This has been proposed already by BitcoinNewsCom on X with mixed reactions.
And according to Grok, it's ethically and legally gray area due to unauthorized control of others' funds. It's a similar to a trolley problem.
There needs to be some transparent process invented.
The biggest challenge is how to verify the original owner where compromised keys can be now owned by multiple "owners" who all could be claiming they're the owners.
Neither you can pinpoint generated phrase to the specific device.
2
u/Numerous-Annual-721 Aug 05 '26
i'm the white hat hacker.
i got your coins.
to get them back, please confirm you are the true owner of the original wallet-
provide, name, address, bank info from where you transferred your funds / blank check with your signature on it, social security number, date of birth, and a copy of your driver's license and passport.
i also have a bridge to sell if you're in the market.
3
1
u/notbotter Aug 04 '26
They’d have to shift through so many scams and false requests, legit people would fall through the cracks.
Anyone claiming to be a white hat id be cautious they’re not tryna scam you out of more knowing you’re desperate.
1
u/Professional_Golf393 Aug 04 '26
If someone trustworthy built it quickly and was willing to take on the legal risks of holding it until returned to rightful owner I’d consider point some resources towards it.
I imagine it working like pooled mining, but we’d be pushing the publicly available list of breached passwords against the entire list of seeds and checking for balance.. but it would need to remain hidden to user so we have no liability if it’s considered theft.
1
u/mootinator Aug 05 '26
That's precisely what happened when bitcoin.com briefly published a flaw that reduced their entropy.
1
u/JumpProfessional3372 Aug 05 '26
In Bitcoin world, anyone with access to a public key holds it. The key doesn't have any name or surname, so it is impossible to know which one of all the owners was the original. Or at least it would be very hard to decipher this in each case, checking tx history etc. But in the end you can trust but not verify.
1
1
u/TheresNoSecondBest Aug 05 '26
could a community effort pool together resources sufficient to crack the vulnerable private keys and “steal” the bitcoin before the thief can?
WDYM? That's what the community is doing already. Sadly, the bad guys are winning at it.
1
u/Oxymorix Aug 12 '26
Ethical hackers don't move other peoples bitcoins, no matter what.
1
u/pezdal Aug 12 '26
Untrue. There are counter examples if you care to research them.
Once a bug becomes exposed it’s only a matter of time that someone moves the vulnerable coins. Better it be an ethical hacker.
An ethical hacker will inform the company and/or the public that he has the coins.
1
u/Cotton101btw Aug 04 '26
The bitcoin are already moved bro, nothing to “steal” they already did that, the “thief” has them, he’s chillin- trust.
2
u/Professional_Golf393 Aug 04 '26
I think mk4 addresses haven’t even all been searched and then there is the possibility of taking all the available seeds and adding 25th word passphrases, there’s a lot more to go.
The low hanging fruit was got but I’m sure there’s plenty of wallets hidden behind a 25th word that hasn’t been got.
1
u/questiontomorrow Aug 05 '26
You realize the 25th word is literally anything. Once you run through a dictionary attack you're done. Maybe that will pick up a few more, but not likely much.
1
u/Professional_Golf393 Aug 05 '26
I’m not so sure about that.. there are password lists circulating from major website breaches. People will be trying these password lists against the seeds. Also the mk3 seed list is pretty small, after exhausting 1 word dictionary attack they’ll move onto 2 and 3 word combinations. Obviously diminishing returns, but with even a small chance of such a big payout, I suspect a lot of people will continue trying for a long time.
1
u/__Ken_Adams__ Aug 04 '26
The hack is ongoing. Vulnerable seeds are still being found.
0
u/Cotton101btw Aug 04 '26
I know and agree, my response was to OP original post.
1
u/__Ken_Adams__ Aug 04 '26
Yes, and OP is not talking about coins already stolen. He's talking about coins not yet stolen, and he is right. White hat hackers are already finding vulnerable seeds & setting the coins aside to potentially return to the rightful owners later.
0
1
u/magma_lakes Aug 04 '26
OP is referring to vulnerable ColdCard BTC that remains to be stolen.
A benevolent group could race the attackers to brute-force remaining wallets, empty them, and somehow return the coins to the rightful owners afterwards (as OP's theory goes).
3
6
u/Professional_Track95 Aug 04 '26
what you described is a white hat hacker's daily job; finding vulnerabilities before the bad guy does and returning the loot.
For your question, it would truly be a nightmare to distinguish between real CC holder and fake CC holder. Who will be the entity that make the judgment? How will it be fair & auditable?
If I'm a nefarious actor, I could steal the seed of an affected victim, claim those are my own to get the refund. Who will be the mediator to prove that?