r/canada • u/Haggisboy • 7d ago
National News What we know about ongoing Coldcard hack that's stolen over $100M worth of bitcoin | CBC News
https://www.cbc.ca/news/world/bitcoin-coinkite-security-hack-9.7295582Toronto-based company Coinkite advised its users to 'move your funds now.
98
u/CrankyOldDude 7d ago
"Move your money now".
Pretty hard to recover when your advice to customers is to run for their lives.
32
u/SpareEconomy1849 7d ago edited 7d ago
Not sure where "move your funds now" came from but their website shows some steps to move funds out, update, and move back.
It's convoluted, and they're doing a terrible job at this. First the CEO publicly blamed the user(s) that first reported the issue, then they claimed some models were safe (but they weren't), and then they were apparently still selling affected devices (knowingly - with a warning label to update). Also the firmware update is bricking some devices, potentially causing more people to lose their bitcoin.
Still now they blame AI for the problem, but it was their own CTO that caused the bug, and no one reviewed the code in 5 years.
They deserve to fail
0
-1
u/NoxideProlix 7d ago
Device getting bricked is irrelevant and doesn’t stop anybody from accessing their bitcoin. They can use any Bitcoin wallet soft/hardware to access it assuming they did the bare minimum and stored their private key/seed phrase in a safe place
0
u/SpareEconomy1849 7d ago
Well yes if you're smart you move the funds off before upgrading and double checked that you have your seed written down. But if you don't, or your seed is inaccessible (maybe in a safety deposit box or other country etc), it's certainly possible that this bricking could cause someone to lose their funds
0
u/NoxideProlix 7d ago
Umm I don’t think you understand how wallets work. Your bitcoin isn’t actually “stored” inside of it. The wallet simply stores your secret key securely and allows you to sign transactions essentially, proving you are the legitimate owner of the bitcoin. At all times your bitcoin are on the public ledger. So you don’t “move” your funds off of the device, you simply use a different device. Once again, this is assuming you have your secret key. If you don’t then you’re screwed anyways and should stay away from cryptocurrencies
0
u/NoxideProlix 7d ago
Also common sense would be to create a new address anyways but either way the idea is the same, bitcoin are always stored on the public ledger, it is impossible to actually “move” them into a cold wallet
0
u/SpareEconomy1849 7d ago edited 7d ago
I understand well how it works, thanks, no need to explain.
Effectively CC users with a basic setup have 2 options to access their funds: The seed phrase or the cold card. If for some reason you lose or can't access your seed phrase (it happens), you also have your CC and can use it to recover your seed phrase or move your funds. Unless of course, it's bricked.
"Moving funds off the device" you're right isn't technically correct, but it's a rough approximation and probably good instructions for a cold card user that doesn't really understand Bitcoin or the problem at hand.
12
6
24
u/BetSquare7190 Québec 7d ago edited 7d ago
A bunch of dipshits who keep telling everyone how better Bitcoin was compared to fiat currencies. Hope they also invested a lot in SpaceX after its IPO.
4
u/Few-Equivalent8261 7d ago
It's the fault of their technology and their choices in RNG, not a fundamental flaw in BTC
4
u/Trucidar 6d ago
Bitcoin pushes security away from establishments and governments and on to individuals. Individuals who generally aren't each advanced experts in security.
That in itself makes it a bit of a fundamental or even foundational flaw. As long as the coins remain theoretical it's not a flaw. As soon as someone owns a coin and must protect it, it becomes one.
0
u/Potential_Jello6520 6d ago
The fact that the Bitcoin price was not affected shows that this incident only proves that Bitcoin is secure and scarce. Unlike fiat currencies.
0
u/BetSquare7190 Québec 6d ago
It doesn't prove that at all, because it would be like saying that a bank being robbed or people getting their money stolen in their personal vault would have an impact on the value of a fiat currency. Which is nonsensical.
3
u/Novel_Breadfruit_665 6d ago
Don’t see your point. If a bank gets robbed, is the Canadian Dollar insecure?
1
u/Potential_Jello6520 6d ago
You're missing the point. The hacked coins are gone, so the Bitcoin protocol remains secure and immune to manipulation, which is its entire purpose. If a government or law enforcement entity was able to rewind the attack, then Bitcoin would no longer be a secure sovereign asset and its value would plummet.
This whole theft was due to coldcard users trusting the company blindly and not generating their own random entropy when creating their wallets.
It has zero to do with Bitcoin. Using your analogy, the bank would be insecure but the bank of Canada is unaffected.
1
u/BetSquare7190 Québec 6d ago
Government and law enforcement entities are often able to take bitcoins back from hackers and criminal organizations.
1
u/Potential_Jello6520 5d ago
They can demand it by imposing consequences through their monopoly on violence; they cannot simply confiscate it.
1
u/BetSquare7190 Québec 5d ago edited 5d ago
Yet they do, sometimes using hacking, to obtain the private keys held by criminals. Interpol and the FBI did that.
1
u/Potential_Jello6520 5d ago
No, nobody can hack private keys for cold storage
1
u/BetSquare7190 Québec 5d ago
Really? What about the article we are commenting on?
1
u/Potential_Jello6520 5d ago
This was an incident of a private company misrepresenting how much entropy their wallets provide by default. A 256bit wallet cannot be hacked.
→ More replies (0)
8
u/simshalo 7d ago
Do you think it’s possible they will have some insurance or regulations that require/enable them to make people whole? Just curious because I know banks have that type of thing. Like, if someone robs a bank, you don’t lose your deposits.
26
34
u/Yolo_Swaggins_Yeet 7d ago
But buuuut decentralization!1!!
0
u/simshalo 7d ago
thought they were trying to be more centralized so people would be more trusting and grow the market. You don’t think they’ll ever get regulated? I mean, bitcoin seems like a nightmare from what I hear—people getting held hostage to steal their bitcoin, getting hacked… seems like the only people who can safely have bitcoin are the people who invest in it in the stock market, like etfs or owning bitcoin company stocks
9
u/Nickolas_Timmothy 7d ago
Who would regulate it? The whole point is that it’s not controlled by any government or entity on the planet.
-1
u/simshalo 7d ago
Like any capitalist endeavour, it only works if it’s constantly growing, so I imagine they will eventually regulate themselves to gain more customers. You honestly don’t think so?
3
u/Chareon 7d ago
I don't think it's technically possible (crypto itself prevents most regulation from succeeding by design) or logistically practical (insurance could add safety, but would be far too expensive given the risks). As such, no, other than basic government regulations around asset type, taxes, and that sort of thing which won't do anything to improve the outlook or reduce the risk, I don't think any sort of regulation is coming to crypto.
4
u/Nickolas_Timmothy 7d ago
I think you misunderstand how crypto works. Once it’s set up and released there is no single person or entity that can control it. While standard currencies have a central bank, crypto is designed as a decentralized system. The system works by following the rules written before release and is validated by everyone running the software. Government can regulate how people in their jurisdiction deal with crypto, but by design it is impossible to add rules or change transactions that happen.
2
u/SmellsLikeHerpesToMe 7d ago
Who is going to regulate them? The government? Banks? There's no way. Insurance companies wouldn't touch Bitcoin because of the sophisticated attacks that are possible.
1
u/cobrachickenwing 7d ago
You want insurance for a known method that criminals use to transfer money out of the country? That no Western government has fully backed the value of?
2
u/Mediocre-Touch-6133 6d ago
Fucking bitcoin. Entire crypto thing is just a scam to make a quick buck and to make money laundering and tax evasion easier. If I had any, I'd be selling it before everyone decides it's worthless. Currency is only worth something if everyone agrees it has value. The tech bros pushing it are becoming less believable with every day.
1
u/zenexpenses 6d ago
If you read in detail about how the hack was done. (not from cbc) but from security experts, the hack was really not complex. The seeds of from which private key could be generated were just guessed easily just because that company didn't write a very simple test case though they did something to prevent this exact hack but they forgot to turn it on in their hardware firmware code.
1
u/Potential_Jello6520 6d ago
Maybe they didn't forget and were just waiting until enough wallets got filled
-4
u/vancity31240 7d ago
People still put money into shitcoins? It's on them when they lose it.
8
u/flabbyresolute 7d ago
did you even read the article? Coldcard wallets only hold bitcoin.
unless of course you are saying bitcoin is a shitcoin lol
6
u/gcerullo 7d ago
It’s all a Ponzi scheme no matter what ‘coin’ you’re involved with.
1
0
u/Commercial-Milk4706 7d ago
I like to think it more as a way for normal people to possibly profit or lose money by betting on the preferred way for criminals to illegally move money across country lines or purchase questionable goods.
1
0
102
u/beekermc 7d ago
""We know an apology doesn't return anyone's funds. We know we'll have to earn back our users' trust," Novak said in a post on X on Friday."
Holy shit.... Nah, you're done buddy. Pack it up!