COLDCARD

Today is a sad day in the space. I take no pleasure in writing about this.

A serious exploit has been discovered in Coinkite’s COLDCARD firmware.

I want to begin with my personal conclusion first. Genuine self custody is still a worthy pursuit. With great power comes great responsibility may sound cliché, but it applies here. If you told someone to spend a week learning how to take full control of their wealth, that would sound like a very good trade. The truth, though, is that most people do not accept that trade. I would like to think that is mostly because of a lack of knowledge. This space is still young. These are still uncharted waters.

COLDCARD is a device that has long been respected by many of the most technical people in Bitcoin. That is part of what makes this so painful. The core idea of the exploit is simple. A wallet is only as secure as the randomness used when it creates the secret. If the randomness can be reproduced, the keys can be reproduced. People who used a COLDCARD believed they were buying a device that created sufficient randomness. A bug revealed today showed that assumption was wrong.

At the technical level, the issue is that certain COLDCARD firmware versions did not rely fully on the hardware random number generator when creating a seed. Instead, the process could fall back to a more predictable path. On some affected devices, that may mean the secret was generated from device data and timing information that could be modeled or constrained. This matters because if the randomness going in is narrower than people think, the range of possible wallet secrets is narrower too.

I have been able to reproduce the exploit myself. I have no desire to share even a semblance of a guide on how to do it. Everyone with the skill to perform this kind of work has a choice to make. A long time ago, I chose to study these things from the white hat side. So I will only say this plainly: from my point of view, this is a staggering oversight on behalf of Coinkite.

My father told me something a long time ago: “Treat everyone like a criminal. Honest people will not mind.” Bitcoin taught me: “Don’t trust, verify.” Today was another reminder of something every serious security engineer already knows. Do not build your security around a single point of failure. Do the work to do it right.

To everyone who lost funds today, I’m so sorry. I hope you can find solace in remembering how early things are and see clearly for the long term.

Later edit: After publishing this, Hodlonaut went into remarkable depth on the attack. His piece, The Paranoid Wallet, is the most thorough breakdown I have seen.