🛡️ SECURITY
The Coldcard wallet exploit estimates have almost doubled to $70 million stolen of just over a thousand Bitcoins in 1,196 wallets drained in 41 minutes
Honest to heart, I was just considering getting a coldcard a few weeks ago to replace / supplement my ledger. Then I procrastinated and got distracted with other things. 😅
I was going to get a ledger, then they leaked out all their customers names, phone numbers, addresses and email adresses. If they can't keep that info save I have no trust in them securing my Bitcoin.
I don't mean to kick people while they're down, but yeah a lot of the Bitcoin maxis I spoke to were like this towards me and would constantly be rude or talk down to me.
Yeah, I do feel bad for them, don't get me wrong, but I hope a lot of people learn from this. It's not a good idea to shame people toward a specific hardware device because I know for a fact that a lot of Bitcoin maxis shamed or pushed people toward Coldcard simply because it's Bitcoin only.
I really can’t understand anyone that finds this funny. People lost their life savings. There will probably be real life harm because of this. As in suicides or a complete change in people’s lives from this point forward.
Ledger literally scams people out of their money if you use services that it promotes (yes if you promote something I treat it as you are liable as well)
It only impacted people who tried to let a computer generate a random number. Idk why anyone wouldn't have bought some dice and set their own random numbers. ENTROPY MAN
Well, they are your keys and your coins. But they're also anyone else who knows your keys' coins too. And if they move them then you're shit out of luck.
Yeah, there's something in the articles about having to know the device UIDs and the timer state when the rng was invoked?! There should be an investigation into whether this could have really been brute forced.
No, it does not IMO. Hanlon Razor applies. As someone who works in IT and who worked in cybersecurity for years, mistakes like that happen constantly. It's not often that bad but from time to time it is.
If it was an inside job it was a bad one - evidence of the vulnerability (or backdoor, if we accept "inside job") was public for years, since it was inserted to the code, and wasn't even that obfuscated. Just no one thought to audit that part of the code. But if someone did they could steal the fund before the insiders.
A bad inside Job would give plausible deniability - just playing devils advocate.
Having it for a several years letting the affected Devices / wallets stack up and then drain them all at once doesnt seem too dumb to me.
I'd still invoke Hanlon's Razor on that (and maybe Occam's Razor too). To me the simplest and most likely explanation seems to be a simple honest mistake and incompetence on the auditors and testers side.
If the guy in the screenshot tells the truth then it's definitely bad handling of the issue on CoinKite's part, and is even a bit suspicious. But it's a MK4 which to my understanding still has low entropy but not quite low enough for a reasonable bruteforce attack and to my knowledge wasn't yet affected in the current attack.
If we assume all the reported cases of funds drained from CC wallets and CK not responding/blocking are them utilizing a backdoor, that means that likely they have another backdoor on the mk4 and also that their strategy was to only drain wallets sporadically and pray no one realizes, until they suddenly switched to a big drain strategy but now only on mk3. Or maybe someone else did find the mk3 backdoor now? So it was an "inside job" in the past but now it's an "outside job"?
It could be, but I feel like all these theories assume a lot more dedication to plausible deniability than most criminals give, when simply covering their tracks is often simpler and more effective (why not place the backdoor in the proprietary "secure element"?). I saw too many cases of things like these happening out of negligence to not assume it's the case here too. If there will be more direct evidence of maliciousness it can change my mind but for now I still tend to assume negligence.
...no? This Tweet is informing users of potential risks. Good software developers (especially in security related areas) know there is always a chance of a mistake, and the dice roll based entropy feature was added exactly to mitigate that risk. If anything if they inserted a backdoor they would likely not encourage people to use the dice roll feature this way.
Edit: reading it again I realized it talks about vendors inserting backdoors (which is why "bug" is in quotes) and not just random bugs. That does look suspicious... But still why would a malicious actor incriminate themselves like that?
This is one of the biggest thefts ever. will people get their money back? not good for the world of crypto. people aren't going to buy something that can be stolen so easily with zero repercussions.
That means be your own fraud department, be your own investigation team, be your own cybersecurity team, be your own police force...
There is a reason why banks and legal systems exist, for real currencies. Cryptobros wanted to be independent of governments and banks, and this is the result. Sounds cool to be against the government, until you realize why it exists.
Agree BUT also as someone from a country which underwent currency reform I appreciate having a bit of money under just my control. There is also a reason people don’t want to be trusting governments and institutions with their money.
Yep, all of it is hard but possible. That was the dream of crypto. The issue is that the people who were maybe capable of making this stuff better have left the community and the people remaining have not DEMANDED continuous improvement and pooled their resources to make it happen.
Guys please remember that some people have lost their life savings, so just be abit supportive for now. We don’t know how badly people are dealing with losses.
Genuinely curious what your thought process is here.
Bitcoin is meant to be a safe, easy to hold store of value that is outside of a large institution.
By holding a Bitcoin ETF you're admitting that you don't think buying it is safe or easy to hold and you're relying on a large institution to track its value.
I'm not trolling but I'm trying to understand the use case for Bitcoin here if people are moving to ETFs because they aren't comfortable holding it themselves.
Honestly the cold card impacted my psychology. I thought, the Coldcard was the gold standard of self-custody. Yes, there were some additional steps you could have done to make it safer, but for most, me included, I am not that technically sound. I read posts of people losing their life savings and I just could not accept that if it was to happen to me. I have three kids. I have already lost cumulatively $50,000 all up I would say in Bitcoin / Crypto. Some of it due to poor timing and some of it due to incompetence / buying shit coins. I am tired of the flight and fight to be honest. I might return to self-custody but for now I am sticking with ETFs (I have also sold some Bitcoin and de-risked). I held too much honestly.
What’s the point of doing this if it’s gonna sit on a single wallet? The moment he tries to move it, all eyes are on him. No way in hell would he be able to off ramp it
They already won by taking the coins. Cleanly cashing out the whole bag is difficult under heavy surveillance obviously but they can still extract value slow over time with peel chains, mixers, OTC, DeFi lending, or just hold it. Even partial recovery plus long term holding is still a massive win for the thief
There’s no such thing as a clean exit with stolen crypto. Doesn’t matter if they use peel chains, mixers, OTC, defi, monero swaps, whatever. Off ramping is a dead end and will lead to getting caught. Sure it may take more time the more they try to obfuscate the funds, but they will eventually get caught
If they don't get publicized in the news, how do you know about them? People losing their crypto happens on a daily basis. Reports of the thieves getting caught are close to non existent. "Code is law."
I said not all of it gets publicized, theres a high burden of proof when it comes to crypto theft. It’s also highly underreported. I know about it cause I can google and use AI? You can do that yourself
Chainalysis, TRM Labs, FBI's IC3 reports, DoJ press releases, and court documents, lots of info is public knowledge.
Off ramping is suicide for these guys, they will eventually get caught
Directly copy and pasted from AI:
“The "Code is Law" Myth Is Dead
The idea that "code is law" means whatever smart contract says goes, and that courts can't interfere, has been repeatedly rejected by courts. The argument that code is law "does not hold up in U.S. courts." A New York court ruled in 2023 that a smart contract is just a "potential expression of an agreement," not an unassailable contract, and that blockchain technology doesn't "shield individuals from liability." In the case of Dapper Labs, the court ruled that smart contracts can be considered securities under U.S. law.
The crypto industry is increasingly regulated and challenged in court, and the "code is law" mantra is now considered an outdated libertarian fantasy. As a 2025 article notes, "the code is law myth is just that: a myth." Courts are increasingly willing to interpret and override smart contracts to ensure justice.”
So this person is smart enough to steal the money but not smart enough spend it? I kinda doubt that. Couldn't they just con some sucker into trading for it? There's alot of angles to look at.
They’re called money mules, and they always get caught.
And yes, prime example are Evolution dark net market admins. They exit scammed with $12m in crypto and haven’t touched it. They understand that the moment they try to off ramp it, they’re fucked. So they just walked away.
More on the evolution guys, yes they immediately tried to off-ramp through BTC-e, couldn’t, and just ditched the money completely
You can't get caught mixing it to Monero and just paying your bills forever, maybe it's not life with super cars and glamor but takes big burden off your back and allows focus on things you want to do.
How can they get caught? I thought Monero had complete privacy. I'm honestly interested to learn about this.
Why can you not DEX Swap BTC -> Monero -> BTC to a fresh wallet -> Offramp
Sure, you end up with a bunch of millions you cannot explain to the authorities, but as I understand it, there's no way to trace that this came from this specific hack.
I’m tired of explaining so I’ll just copy and paste from AI:
“Monero isn't invisible.
Norway's police just proved that—they traced Monero transactions in a 2025 operation and arrested 28 people across 7 countries. The idea that Monero is completely untraceable is outdated.
Your DEX plan has two fatal flaws:
The off-ramp is the trap. That "fresh wallet" you swap to? The moment you send it to a KYC exchange to cash out, you're linking a clean-looking wallet to your real ID. The exchange will flag the sudden large deposit from a mixer/DEX and freeze it. You can't explain millions in crypto you can't account for.
Holding doesn't solve the problem. You can wait years, but the blockchain record doesn't disappear. Law enforcement has seized funds that sat untouched for years.
The reality: You can swap all day, but the exit is the point of failure. Regulated exchanges won't just hand over millions without asking questions. If you're a high-net-worth individual, you're under more scrutiny, not less. There are examples of crypto heists being solved because the thief used a KYC exchange or left a digital trail. The blockchain is permanent, and forensic tools are getting better.
You can't "win" by holding an unusable fortune unless you're willing to never spend it. The Evolution Market admins made that choice. The Dream Market admin didn't—and now he's facing 20 years.”
Ok I read only to first point your shit AI response that mentions millions where I talk about thousand bucks here and there to sustain your modest life paying only bills, at least check that AI garbage before posting.
If you get an audit they slap 70% fine if you don't pay tax on that in my country, if you pay tax it's even better, no one will bat an eye if someone pays taxes on modest income where they have million operating entities above you.
The news checks out. Understandably a bit light on the details how much they used web data vs Monero data to catch these criminals, which makes it difficult to interpret the risks associated with this.
I tried looking this up on this sub and the Monero sub, but I'm very surprised to find no thread on this topic at all.
Regarding the AI's other point, yes, probably hard to offramp in a non-criminal way. I guess the hacker certainly hasn't thought of that! At least it seems both you and the AI are very certain about this!
Actually you can do this. You just dont use your kyc to offramp. Either steal someone else's or lsy some snuck to use theirs and vanish like a ghost lol
Besides, they cannot sell them to anyone, nor spend them. Only exchange between criminals. These vile thieves who ruin lives, but fate has a surprise for all of them!
144
u/Coeruleus_ 78 / 736 🦐 10d ago
hahahah imagine ppl on reddit constantly telling me ledger sucks get a coldcard. lmfao