[SUI-3183372]

Do you think the attacker had this exploit running against address for months or years before actually draining wallets? Seem to me that running that many combinations would take a lot of time. Assume the attacker once they found the exploit wanted to maximize the theft.

I also think it's odd they moved all the BTC into a few addresses. Less addresses are much easier to track and block.


bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r (562 BTC)

bc1qx76cae2706qd5q576feh7xq8rfcsjpf2htfhe3 (398 BTC)

Hard to say without understanding the full seed space. Per The Block, they're estimating this seed space was roughly 2^32 (4.3 billion) seeds. Coinkite argues against The Block's claims, with an argument that effectively boils down to the seed space being somewhere between 2^32 and 2^40 (4.3 billion to roughly 1 trillion) seeds. This is much higher than I estimated in my last post, but still a trivially low number.

Theoretically each seed can have many addresses that hold funds, I'm uncertain if the attacker checked many addresses, or just the address at index 0. I'd probably only check index 0, at first pass, and then check for additional addresses pertaining to any seed that had an active address at index 0.

Lets assume the 2^32 number is correct, then a sufficiently thorough attack would result in a seed space of 4.3 billion seeds checking 4.3 billion addresses sitting in index 0. If the attacker is a Hackforums user sitting at home with a 4090, then they pulled it off in no more than 12 hours, potentially as low as just 2-3 hours. An attacker with more resources could pull it off in 10 minutes.

If the 2^40 number is more correct, then just multiple the above times by 20x-25x.

Basically anyone with a gaming PC and an open Friday night could have pulled this off. Any of you here responsible? 😋

I also think it's odd they moved all the BTC into a few addresses. Less addresses are much easier to track and block.

bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r (562 BTC)
bc1qx76cae2706qd5q576feh7xq8rfcsjpf2htfhe3 (398 BTC)

Lazarus group have proven that consolidating your stolen funds ON BITCOIN results in no real hardship for them. If you were pulling off smaller thefts and trying to fly below the radar, sure, keeping things fanned out is probably for the best, but a theft as big as this you were going to have a lot of eyes on you anyway. I'd just follow the north korean playbook:

1. Consolidate funds (This step may swap with step 2 depending on what chain and bridges you need to use)
2. Move funds to BTC as quickly as possible assuming they aren't already
3. Go dormant for a few years
4. Launder aggressively once the heat dies down / dear leader asks for money

[Omniscient]

Hard to say without understanding the full seed space. Per The Block, they're estimating this seed space was roughly 2^32 (4.3 billion) seeds. Coinkite argues against The Block's claims, with an argument that effectively boils down to the seed space being somewhere between 2^32 and 2^40 (4.3 billion to roughly 1 trillion) seeds. This is much higher than I estimated in my last post, but still a trivially low number.

Theoretically each seed can have many addresses that hold funds, I'm uncertain if the attacker checked many addresses, or just the address at index 0. I'd probably only check index 0, at first pass, and then check for additional addresses pertaining to any seed that had an active address at index 0.

Lets assume the 2^32 number is correct, then a sufficiently thorough attack would result in a seed space of 4.3 billion seeds checking 4.3 billion addresses sitting in index 0. If the attacker is a Hackforums user sitting at home with a 4090, then they pulled it off in no more than 12 hours, potentially as low as just 2-3 hours. An attacker with more resources could pull it off in 10 minutes.

If the 2^40 number is more correct, then just multiple the above times by 20x-25x.



Lazarus group have proven that consolidating your stolen funds ON BITCOIN results in no real hardship for them. If you were pulling off smaller thefts and trying to fly below the radar, sure, keeping things fanned out is probably for the best, but a theft as big as this you were going to have a lot of eyes on you anyway. I'd just follow the north korean playbook:

1. Consolidate funds (This step may swap with step 2 depending on what chain and bridges you need to use)
2. Move funds to BTC as quickly as possible assuming they aren't already
3. Go dormant for a few years
4. Launder aggressively once the heat dies down / dear leader asks for money

I'm wondering for obfuscation if doing a higher index like 15 on a new wallet might help protect against drainers. I gotta assume most of the time they don't go very deep.

[Zexo]

Sick< i wish it was me that ran into that find lol :D

---

Well done to whoever did this if they dont need the change throw it this way wont ya ? :)

bc1q9fv7lvqhdjzut26077st8dgpecumjupavgch9u

You'd be getting a knock on your door.

[SUI-3183372]

I'm wondering for obfuscation if doing a higher index like 15 on a new wallet might help protect against drainers. I gotta assume most of the time they don't go very deep.

It could definitely save you. Use index 495, I'm certain there are scenarios where someone checks just index 0 or the first ~20 or so.

Your seed is still compromised, and thus should be considered burnt, but at least it may save you in a large scale attack that's not checking all indexes of all seeds.

[Omniscient]

It could definitely save you. Use index 495, I'm certain there are scenarios where someone checks just index 0 or the first ~20 or so.

Your seed is still compromised, and thus should be considered burnt, but at least it may save you in a large scale attack that's not checking all indexes of all seeds.

Should at least buy you some time.

I just found out a local buddy of mine with a very reasonable BTC sum had used the Coldcard wallet. He says he didn't lose anything but he's scrambling to rebuild his storage right now.

[ModernEHustle]

AI is making being a black hat much easier.
I wonder if it’s going to be another Malone situation.

[SUI-3183372]

Should at least buy you some time.

I just found out a local buddy of mine with a very reasonable BTC sum had used the Coldcard wallet. He says he didn't lose anything but he's scrambling to rebuild his storage right now.

This only impacted a subset of Coldcard users.

Any seed generated before March 2021 is safe.
If you added a sufficient amount of additional entropy while generating, you're safe.
If you opted in to BIP-39's 25th word (passphrase), you're safe.
Devices Mk4, Mk5, and Q seem to be vulnerable, but at a 2^72 vulnerable seed landscape vs mk2 and mk3's 2^32 vulnerable seed landscape.

[Jahad]

Oh wow, I thought the whole point of physical hardware wallets was to make sure this kind of stuff doesn't happen.

[NoodleBot™]

Oh wow, I thought the whole point of physical hardware wallets was to make sure this kind of stuff doesn't happen.

It is. But as developers they failed to add the appropriate RNG kind of think of it as a video game where RNG matters like perhaps Pokémon wild encounters or damage in an RPG. There is an element of randomness applied, which requires entropy which is very difficult for humans to do so we rely on specific math for this entropy to work.

If you cheap out and do the lazy route on the math, you’re gonna get entropy, but it’s kind of predictable and it’s replicated by other people that are trying to do the same thing. You’ll end up with the same results over and over again time after time eventually.

TLDR they took the easy way out. There’s tonnes of ways to explain proper entropy and RNG but I’m half retarded so you’re not gonna get that fully out of me.

Here’s something from Coldcard owners site tho

-not my stuff below from Coinkite websites-





“Updated July 31, 2026 at 12:39 p.m. EDT: Fixed firmware is now available for every affected model and release track:

Mk3: version 4.2.0 or later
Mk4/Mk5 standard: version 5.6.0 or later
Q standard: version 1.5.0Q or later
Mk4/Mk5 Edge: version 6.6.0X or later
Q Edge: version 6.6.0QX or later
Standard and Edge are separate release tracks. If you use Edge, install the fixed Edge release for your model. Do not assume an older Edge 6.x release is fixed merely because its version number is higher than the standard release.

Do not generate a new seed on any of these models until the update is installed.

Coinkite is warning all users who generated a seed using a Mk3 on version 4.0.1 (March 2021) thru 4.1.9 (inclusive) that their funds may be at risk.

Seeds generated on Mk4, Q and Mk5 before the fixed firmware releases are also affected, with about 72 bits of entropy rather than the expected 128 bits.

Updating the firmware does not change or repair an existing seed. If your seed was generated before the fixed firmware version for your model, follow the migration guidance below unless the independent dice-entropy exception applies to you.

TAPSIGNER, OPENDIME and SATSCARD are not affected by this bug as they are different codebases

The issue is present on Mk3 firmware versions 4.0.1 through 4.1.9 inclusive. It also affects seeds generated on Mk4 and Mk5 before standard version 5.6.0 or Edge version 6.6.0X, and on Q before standard version 1.5.0Q or Edge version 6.6.0QX. The impact on Mk4, Mk5 and Q is not as severe but is still serious.

If You Added Dice When Creating the Seed

This issue affects the device-generated entropy. It does not remove independent entropy that you supplied with dice.

On affected firmware, COLDCARD hashed the device-generated seed together with every dice roll entered through Add Dice Rolls:

50 to 98 independent, private rolls: the dice input alone contributed at least 128 bits of entropy.
99 or more independent, private rolls: the dice input contributed approximately 256 bits of entropy.
Fewer than 50 rolls, or you do not remember: follow the migration guidance in this advisory.
If you entered at least 50 fair and independent rolls, and the rolls were not recorded or exposed, we do not consider the resulting seed at risk from this RNG issue alone.

This applies to the final seed words shown after the dice were added. If you are uncertain which words you used, how many rolls you entered, or whether the rolls were private, migrate to a new seed.“

[Mewtwo]

This only impacted a subset of Coldcard users.

Any seed generated before March 2021 is safe.
If you added a sufficient amount of additional entropy while generating, you're safe.
If you opted in to BIP-39's 25th word (passphrase), you're safe.
Devices Mk4, Mk5, and Q seem to be vulnerable, but at a 2^72 vulnerable seed landscape vs mk2 and mk3's 2^32 vulnerable seed landscape.

Do you think AI found this? Or did someone planted this out secretly from their internal side?

If it’s AI, I’m sure there’s going to be a lot of logs and traces back to that. How likely can an AI company be sued for finding a bug that allowed someone to steal this amount?

I’m sure stuff like this is going to push politicians to be more stricter on the cybercrime aspect. Punish the companies for facilitating a crime like an accomplice if no proper safeguards and verifications are in place.

[Shapeless]

You'd be getting a knock on your door.

Hehe not where I am, I am in islamic republic probably would get a thank j card.

[SUI-3183372]

Do you think AI found this? Or did someone planted this out secretly from their internal side?

If it’s AI, I’m sure there’s going to be a lot of logs and traces back to that. How likely can an AI company be sued for finding a bug that allowed someone to steal this amount?

I’m sure stuff like this is going to push politicians to be more stricter on the cybercrime aspect. Punish the companies for facilitating a crime like an accomplice if no proper safeguards and verifications are in place.

I imagine it's very likely that AI played a role.

Likely identified the March 2021 update that weakened their crypto. Likely identified the manner in which it could be exploited. Using Kimi, it may have even written the exploit code for them.

[Three]

The mistake made by the individuals whose BTC was stolen was using only a single hardware wallet. Holders of large amounts of BTC should use two different hardware wallets.

Someone on Reddit had 0.8 BTC stolen; that's a lot of money.

For example, the Ledger Nano S Plus is 70 USD. Trezor Safe 3 50 USD...

I am not saying these are bug-free or completely secure. At the very least, if an error occurs, your entire cryptocurrency holdings won't vanish. It is impossible for your funds to be stolen from both hardware wallets simultaneously.

[SUI-3183372]

Your BTC key is just fancy cryptography that can be replicated anywhere, you don't need a wallet provider or any third party to generate a valid BTC keypair and address.

1. Set up local / air gapped environment to generate BTC keypair
2. Generate your own keypair
3. Never connect this keypair to any hardware or software wallets
4. Send funds intended for cold storage to address
5. Store key in a KeePass database (local encrypted pw manager)
6. Store database on numerous USB drives
7. Store USB drives in safe locations

If someone finds a USB, they won't be able to decrypt your database assuming you've chosen a sufficient pass phrase.

[Omniscient]

Your BTC key is just fancy cryptography that can be replicated anywhere, you don't need a wallet provider or any third party to generate a valid BTC keypair and address.

1. Set up local / air gapped environment to generate BTC keypair
2. Generate your own keypair
3. Never connect this keypair to any hardware or software wallets
4. Send funds intended for cold storage to address
5. Store key in a KeePass database (local encrypted pw manager)
6. Store database on numerous USB drives
7. Store USB drives in safe locations

If someone finds a USB, they won't be able to decrypt your database assuming you've chosen a sufficient pass phrase.

Correct.

Hardware wallets aren't all that fancy imho.

And using encrypted USB drives is one method I personally use.