Café Bitcoin | Coldcard Emergency: What Happened, Who's Affected, and What To Do Now

The event. A firmware flaw in Coldcard seed generation, disclosed the night before, let an attacker recompute private keys outright. By airtime, 594 Bitcoin, put at roughly $38 million on the show, had been swept from about 500 wallets.
The mechanism. Yan Pritzker and Swan engineer Steve: the device's true random number generator was present and working, but a March 2021 library change meant the firmware silently stopped using it, falling back to software randomness seeded from device ID and clock.
Why five years passed. The code looked correctly wired, the failure hinged on a build-time variable, and the output still looked random. Zach Herbert of Foundation said a researcher flagged something adjacent in 2022 without unraveling it.
Who is exposed. Only seeds the Coldcard generated itself. Imported seeds are safe, dice rolls are safe, a long passphrase saved people. MK3 is worst hit. MK4, MK5 and Q sit near 72 bits, costly to attack but not impossible.
Updating firmware does not fix it. Coinkite patched, including MK3, but the vulnerable seed is the problem, not the device. You must generate a new seed and move funds. The dice function was never affected and has now been audited.
Multisig is not automatically safe. If most keys came from affected devices, an attacker can try permutations, and spending publishes your public keys and invites an RBF race. Wicked pointed people to Portland.HODL for private broadcast through Slipstream.
The attacker looks unsophisticated. The sweep ran roughly 25 minutes into a handful of addresses, stopped at shallow address gaps, and queried a public node instead of running one. Block researchers identified that service, so there may be a lead.
The industry reckoning. American HODL called it a Paul Revere moment and demanded podcasters and former sponsors broadcast immediately. Reardon argued the industry spent three years arguing over the wrong priorities and got caught by an entropy bug.
Self-custody versus diversification. Wicked held that multi-vendor multisig with your own entropy beats any custodian. Joe Carlasare countered that every system rests on assumptions that eventually fail. Yan declined to preach one model, calling self-custody still very early.
Swan's status and the scam wave. Yan confirmed Swan Vault is built on Blockstream Jade and unaffected, and reported an influx of deposits. He flagged a devious scam variant where attackers send you working seed words and ask you to deposit into them.

Det här avsnittet är hämtat från ett öppet RSS-flöde och publiceras inte av Podme. Det kan innehålla reklam.

Avsnitt(669)

Café Bitcoin | The Nuclear Bitcoiner on Mining with Small Modular Reactors, and the Paper He Is Taking to a Nuclear Conference | Day 29 of 50

Ryan MacLeod, who posts as The Nuclear Bitcoiner, works at Canadian Nuclear Laboratories and has spent almost eleven years in the industry as a laboratory technologist. He compares his facility to Ida...

19 Aug 1h 26min

Café Bitcoin | John Haar Returns for Macro and Mining, 55 Years Off Gold | Day 28 of 50

John Haar, back for his first Café appearance since leaving Swan for Blockware, opens on the 55th anniversary of the Nixon Shock. His argument: gold's own physical properties, the time, trust, and arm...

18 Aug 1h 25min

Café Bitcoin | Yan Pritzker on Bitcoin Fork History, the September 1 Hard Fork, and Why Doing Nothing Is the Safest Move | Day 27 of 50

Yan Pritzker, Swan's cofounder and CTO, walks his new essay on Bitcoin fork history, from the 2015 block size debates through the hard fork scheduled for September 1. Published on the Swan blog and po...

17 Aug 1h 20min

Café Bitcoin | Orwellian Overreach, the Museum of Civil Liberties, and the Freedom Tech Field Guide | Day 24 of 50

A museum for things that aren't gone yet. Roxana Nasoi of Logos walks through the Museum of Civil Liberties: five halls, twenty major events, a record kept where it can't be quietly edited. Phase one ...

14 Aug 1h 19min

Café Bitcoin | Self-Custody with Nick Neuman, Money Without Permission and Debanking | Day 23 of 50

Suze takes us inside the UK's debanking inquiry. A director and co-founder of Bitcoin Policy UK, she's submitting evidence to Parliament's cross-party inquiry this week, and explains what an APPG can ...

13 Aug 1h 23min

Greg Foss on Bitcoin as Insurance, Credit Signals in the AI Boom, and Do the Math | 50 Days for Freedom, Day 22

Greg Foss is back. After stepping away from Twitter and spending time on Nostr, the veteran credit analyst explains what pulled him back: young people reaching for socialism, and credit markets he see...

12 Aug 1h 15min

Café Bitcoin | Larry Lepard and Greg Foss on Japan as the Seminal Event, Credit as the Warning, and Why Timing Beats Everyone | Day 21 of 50

Cory's argument about narratives. Journalists and bankers keep asking what the catalyst will be, but narrative follows price rather than causing it. Something moves because sellers are exhausted, and ...

11 Aug 1h 31min

Café Bitcoin | Jeff Ross on Energy Money, Why Abundance Still Needs Scarcity, and Study Before You Stack | Day 20 of 50

The theme was looking forward After two brutal weeks the room turned to what comes next, set up by a listener's observation that the philosophical Bitcoin conversation which drew people in around 2020...

10 Aug 39min