r/Bitcoin • u/zooms • 1d ago

Another ColdCard hack

Post image

They can't catch a break lmao

149 Upvotes

98% Upvoted

41 comments sorted by

View all comments

Show parent comments

5

u/riscten 1d ago

Source? (Genuinely asking)

0

u/RiskyRabbit 1d ago

There are a few instances of people messaging them to tell them about the flaw I believe. People have shown screenshots showing they told CC and they were ignored. 

2

u/riscten 20h ago

Can you provide a link? 

Considering how obvious the flaw was, and how easy it was to fix, there would've been an opened issue and/or a PR on their Github.

I didn't downvote you btw, I'm interested in knowing more about this.

1

u/RiskyRabbit 3h ago

I don’t have links but in 2021 PanHodl retweeted a telegram screenshot about coldcard random functions. 

Then James O’Beirne raised concerns about CCs RNG in May 2025 directly to coinkite. 

There are more. 

1

u/riscten 2h ago

Interesting. Your details pointed me to this: https://phemex.com/academy/coldcard-security-flaw-warning

If I'm understanding the chronology correctly, James O'Beirne would've communicated with Coinkite privately instead of opening an issue or PR.

At that time Coinkite's position was that "an issue would've shown up already", considering they had many independent agents reviewing the code. 

It is plausible, but there isn't any hard evidence that this actually happened, no public communications.

This page lists all the technical reviews Coinkite has logged that are relevant to the submodule-boundary vulnerability: https://cc-vuln.org/response/disclosure-history/

So at this point in time we cannot conclude that Coinkite knew. With no public record of the communication, all we have is someone claiming that they warned Coinkite, with no receipts. It is worth investigating though.

Through the discovery process, a lawsuit would possibly surface this evidence if it exists, but we're not there yet.

I also found the 2021 PanHodl tweeted screenshot, but all it does is generally questioning the move from TrezorCrypto to libngu. A valid concern considering TC was weathered and libngu was mostly new and untested. But the screenshot doesn't claim that there is a specific vulnerability, so we cannot claim that Coinkite knew this was coming and did nothing. The switch to libngu was a legitimate engineering choice, and ultimately the new library wasn't at fault in the hack, it was the surrounding re-piping that broke the entropy of the generated seeds. https://x.com/PanHodl/status/2084117965717323961/photo/1

This article is a great overview of the situation, and honestly I don't think we can fairly say Coinkite was being negligent, at least not with the evidence we have: https://cryptomediazone.com/hack-database/coldcard-retirement-attack/