[Omniscient]

This is making the headlines this morning.

It would seem AI helped cracked their hardware wallet (Coldcard). Over 400 wallets drained in less than 30 minutes. Over $38m dollars. And this is an air-gapped hardware wallet.

The current accusation is that AI found a firmware bug for the wallet in version Mk3. The wallet made easy to replicate seeds.

Not a good day for about 500 people.

[Mewtwo]

Makes me worried about Trezor and other crypto hardware wallets. I’d probably just stick to my own random generated seed from an offline computer

[DramaKing]

How is cracking a cold wallet remotely possible?

[Motusora]

so , are they gonna refund those users ?

[Omniscient]

How is cracking a cold wallet remotely possible?

The rumor is that the way the seed was formed was guessable. The randomness of the seed creation was garbage.

I'd be so livid right now if I list my BTC because of a "secure" air-gapped hardware wallet.

[campusminger]

this is nightmare.
makes you question all hw wallets in market.

[Shapeless]

Sick< i wish it was me that ran into that find lol :D

---

Well done to whoever did this if they dont need the change throw it this way wont ya ? :)

bc1q9fv7lvqhdjzut26077st8dgpecumjupavgch9u

[DramaKing]

The rumor is that the way the seed was formed was guessable. The randomness of the seed creation was garbage.

I'd be so livid right now if I list my BTC because of a "secure" air-gapped hardware wallet.

One seed for 400 wallets? I guess that I'd have to understand how it works.

[Omniscient]

One seed for 400 wallets? I guess that I'd have to understand how it works.

I'm not sure a single seed was generated for multiple wallets. If that was the case then someone with a wallet would have seen one giant balance that wasn't theirs.

Maybe this guys explanation will help.

[bebonzy09]

This is shocking tbh and I never once trusted hardware wallets. I use an air gapped laptop whenever I need to sign or access my funds with electrum, its harder and harder to trust these wallets... Ledger and trezor both had databreaches and issues in the past too.

[SIM-2470866]

cant wait for a case-study from ZachXBT on this.

[Mewtwo]

cant wait for a case-study from ZachXBT on this.

They’re not paying him to investigate so most likely he doesn’t care

[Costanza]

LOL poor crypto can't catch a break but yeah more hacking will happen and the price will continue to go down. no surprise

[SUI-3183372]

Lot of rumors flying around on this one. First and foremost, Coldcard did not roll their own crypto, it uses standard secp256k1/BIP39.

What happened was they unintentionally crippled their implementation of secp256k1/BIP39 back in a 2021 update. The update changed the seed generation call so that it bypassed the STM32 hardware random number generator and fell through to a weak software fallback. This fallback was seeded from a predictable combination of the device's serial number and its internal clock. This resulted in the entropy feeding the standard deterministic derivation was guessable and a much narrower set of possibilities than what it should have been.

This is where it got interesting for me, I was wondering how an attacker would be able to identify a Coldcard wallet on chain and look to compromise it, when the approach is actually far easier and far more efficient. From here, the attacker:

1. Enumerate the plausible serial number/clock combinations that the broken RNG could have used.
   


2. Run each through that same broken path to achieve the BIP32 master key
   


3. Derive address sets from from each master key
   


4. Check addresses against the chain, drain any that hold value.

Essentially, the number of combinations of serial numbers and times created a tiny enough landscape that an attacker can simply generate wallets for every single combination that can exist, and then check which of those hold a balance, and drain them. This likely resulted in millions if not tens of millions if not hundreds of millions of wallets generated, and they probably spent a considerable amount of time mapping which had funds This resulted in 4 billion to 1 trillion of seeds generated, and once they sufficiently mapped their total address set containing funds, they would have struck them all at once.

This is structurally the same exploit as Milk Sad from 2023 and Randstorm from earlier in Bitcoin's life.

[Omniscient]

Lot of rumors flying around on this one. First and foremost, Coldcard did not roll their own crypto, it uses standard secp256k1/BIP39.

What happened was they unintentionally crippled their implementation of secp256k1/BIP39 back in a 2021 update. The update changed the seed generation call so that it bypassed the STM32 hardware random number generator and fell through to a weak software fallback. This fallback was seeded from a predictable combination of the device's serial number and its internal clock. This resulted in the entropy feeding the standard deterministic derivation was guessable and a much narrower set of possibilities than what it should have been.

This is where it got interesting for me, I was wondering how an attacker would be able to identify a Coldcard wallet on chain and look to compromise it, when the approach is actually far easier and far more efficient. From here, the attacker:

1. Enumerate the plausible serial number/clock combinations that the broken RNG could have used.
   


2. Run each through that same broken path to achieve the BIP32 master key
   


3. Derive address sets from from each master key
   


4. Check addresses against the chain, drain any that hold value.

Essentially, the number of combinations of serial numbers and times created a tiny enough landscape that an attacker can simply generate wallets for every single combination that can exist, and then check which of those hold a balance, and drain them. This likely resulted in millions if not tens of millions if not hundreds of millions of wallets generated, and they probably spent a considerable amount of time mapping which had funds, and once they sufficiently mapped their total address set, they would have struck them all at once (This is speculation on my behalf).

This is structurally the same exploit as Milk Sad from 2023 and Randstorm from earlier in Bitcoin's life.

Do you think the attacker had this exploit running against address for months or years before actually draining wallets? Seem to me that running that many combinations would take a lot of time. Assume the attacker once they found the exploit wanted to maximize the theft.

I also think it's odd they moved all the BTC into a few addresses. Less addresses are much easier to track and block.


bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r (562 BTC)

bc1qx76cae2706qd5q576feh7xq8rfcsjpf2htfhe3 (398 BTC)