Bits + Bips: Is Any Cold Wallet Safe? Inside the Coldcard Hack's Wave Three

Transcript

You're listening to a brief segment from one of the Bits and Bips episodes this week. The full show is now only available on its own dedicated Bits and Bips channels. So, be sure to go to X, YouTube, and your favorite podcast platform and search for Bits plus sign BIPS spelled BIPS and subscribe. So, cold card was a hardware wallet largely marketed in some places as the gold standard in the Bitcoin ecosystem and it had a deep systemic flaw. So, an exploit tied to entropy, aka key generation, uh, cold card Mark III, MarkV, Mark Five, uh, had Bitcoin drained from, I believe, well over a

thousand wallets at this point, and the reported total has been climbing throughout the week, up up. Um, CZ via Zero Hedge said nothing is 100% warning Bitcoin holders after the exploit. Uh, we also have an expert who's been commenting on it extensively here, Alex Thorne, who Alex, I saw in Cointelegraph you said a fourth organized wave is likely in progress, 208 transactions across some specific blocks, sweeping about 389 Bitcoin from 462 suspected victim addresses in roughly 2.5 hours. Um, human cost is real here. Good example, the retail bull

had said, "I've had all my bitcoins stolen while away on holiday. It was on a cold card Mark III. I was led to believe this was really secure. The two Bitcoin was supposed to be to give to my two children to give them a good start to life." And the ETF crowd has been speaking up here. Um Eric Balanchuna said, "Such an intermediary upgrade for Bitcoin. safer, more secure, and almost always cheaper. Speaking about ETFs, 33y old industry, 15 trillion in AUM, and never once lost someone's money. So, I could go on and on about this, but Alex, you've been observing the whole thing. Could you

start by telling us like the core of how did people get this wrong? Why was all this money sitting out there in a way that it could be stolen? Yeah, it's it's been a brutal four days. This sort of started early in the morning Thursday UTC time. Um, and is still ongoing. So, before I even go, if any viewer or listener has funds on a cold card in a single signature uh address, as in not part of a multi-segorum, you should move those coins off as soon as possible. Um, and I, by the way, I I like Eric Belchunis quite a lot. Um, but I, you know, obviously an ETF holding a DTC registered stock inside it is not the

same thing as one that holds a digital bearer asset. But we move on. I the saddest part is that to your direct question, Austin, um, these people did nothing wrong. In fact, they did everything right. And the the cold card itself is very popular among um a cultural demographic in Bitcoin that believes in cold storage, self-custody, stacking SATs, working hard. You know, not that anyone deserves to have their money stolen, but this isn't a a drain of a DeFi bridge uh where you were, you know, bridging between, you know, Ethereum L2s to harvest, you know, uh altcoin inflation yield, right? This is not people speculating on crypto

exchanges on meme coins, right? These are people by and large and I can tell you I know this community quite well that are working hard and saving and stacking SATs and then putting them away for a long period of time. Uh the average dormcancy of coins that has been siphoned like almost four years. So the these are not like short-term holders. um that makes it particularly devastating because they did nothing wrong. To your point, just to underline it a little bit um of how this happened. Um when you generate cryptographic keys, you need entropy. Um you need a random number generator to seed uh the key generation with randomness, which is what makes it difficult to brute force

attack. Um, and Cold Card had updated their firmware on March 17th, 2021 to add their own version of a random number generator. And it's not even that that version wasn't good. They miswired it into the firmware. Um, and such that it would it would fail. It it would never be routed through that random number generator and it would fail silently and it would backfall to this other crappy random number generator that has way too weak entropy uh to create secure keys. That means that attackers with compute that know this vulnerability can go and use that random number generator that it did end up using and compute billions of public keys. Then go and and private

keys seeds, seed phrases and then derive the public keys across the whole derivation space and then go and see if any of them have coins and if they do, bam, submit transactions to move those coins to new locations. It's it's the worst type of attack. These people did not accidentally drop their hardware wallet on the ground or post their private key in a chat. They didn't even click a link, a fishing link that siphoned their MetaMask, right? Like so many that we see. Um I think that's what makes it particularly devastating. Um you know, when compared to other hacks, all of which are devastating, but this is really not supposed to happen. So to unpack this one, the problem here

ironically had nothing to do with Bitcoin specifically. This was a core like cryptography exploit where you had a poorly generated at best pseudo random function to create your seeds and as a result of that whatever was secured with that cryptography could have been hacked. So if this had been for instance a I don't know email provider using encryption instead you would have been able to get into everybody's email. Correct. Like this is not a problem unique to blockchains. It is a cryptography problem.

>> Yeah. Absolutely true. And and not Yeah. Not only not a Bitcoin problem. Um could have been an ETH or Solana problem. And to your point could have been you know an encrypted zip file problem or any type of uh key generation. And and the the worst part is it's not even really even the crypto the software and the firmware just failed to route a keych through the number random number generator. This is not the first time that we've seen random number generator problems even in crypto to be clear. Um I think one of the other things that's so astonishing though is how popular this hardware is. It's great hardware to be clear. Like they also make the block clock and the open dime extremely popular Bitcoin native hardware. Um but this this is a software development

failure that somehow went unfound for five years. It probably was found with the help of AI. Um people have proven now that now that it's known that AI can find it. Um but it didn't need AI to find this is there are simply not enough eyes on this codebase. Um there were obviously issues as well with the codebase. It was not fully open source. Um, and when you look at the codebase, there's, you know, hundreds of commits, right, to the master branch with no comments, right? Like, so it's doesn't seem like it was properly reviewed either. Um, but just for some numbers, you know, I'm not an expert in I'm not a software developer. I'm not an expert in

cryptography. Um, and I'm not an expert in um, this type of computation to derive these seeds. U, which is what the attack is. I am an expert in onchain forensic tracing and that's what I've been doing. I've been following the funds here and trying to identify victim and and attacker addresses and along with helping victims if they reach out to me also submitting uh those addresses to relevant US federal government uh law enforcement crypto exchanges, crypto iss um all of the relevant cyber investigators to try to make sure that these addresses get flagged by chain analysis at TRM labs and Elliptic and all the exchanges so that if they do

appear at a centralized intermediary, there's a chance of recovery. Um, it's quite interesting. This started, you know, we've I've got three defined waves, we call it, wave 1, wave two, wave three. Any prospective wave four, which is still sort of in the medium to high confidence. I haven't actually promoted into what I'm considering a high confidence part of the attack. That's one reason, by the way, why it's so difficult to trace. Not because it's Bitcoin specifically, but because these are like thousands of previously unconnected cold storage addresses. You know, if a bridge gets hacked, we go and look at the smart contract address and we see all the funds flowing out of it and we see where they go. this to to actually gather and find all the

examples of people's cold storage addresses being siphoned, we basically have to rely on patterns of attacker transaction patterns and victim reports. And so wave 1 uh which started just after midnight UTC on Friday on Thursday morning, July 30th, was really identified by victim reports around the uh community and then the pattern described and identified by engineers at Block Inc. right? Which Cash App, Square, the Bit Key, um those guys, brilliant engineers there who have their own hardware wallet, the Bit Key, they identified the transaction pattern that then I extrapolated to go find the totality of wave 1. We have I've since talked to dozens of victims who are

confirmed part of wave 1 and that those victim confirmations are sort of how we verify that our pattern analysis is accurate. >> Hey, Alex, can I ask a question? Um wave one through four, same attacker or people piling in and saying, "Oh, I found an exploit." >> Yeah, so wave one is like a bunch of um obviously seeds broken and funds transferred in bulk into one or two collector addresses and then one or two attacker holding addresses and they're sitting there inert. Wave two is a very similar topography. Again, tons of confirmation from victims in waves one and wave two. So, we're very confident in that set. Wave three has a totally different topography. It a very internally consistent one. So we think

it's each of these wave 1 and two and three we're confident um are waves. Um wave three though rather than siphoning many users into one big address which is sort of what one and two do. Wave three has one uh victim per vault storage by the um attacker. So it's like if my 10 addresses all get siphoned in one transaction, they stop at one spot intermediary that's just for me and then they go into one vault that's just for my funds and they're all So there's 293 victims we think and there's 293 vaults.

So I don't know if one, two, and three are the same. I if I had to guess if there is any overlap, I would say one and two are probably the same. Um one and two comprise like 70 plus% of all the funds we think have been stolen. Uh three has a bunch. two. If it if three is the same as one and two, then the attacker demonstrabably changed their operational um process. Wave four is still not totally confirmed. I don't actually have victims yet that I can confirm are in wave 4. Wave four u I identified solely by a burst pattern.

Think about the pattern we're looking for. the the addresses have to have been funded and created after the firmware upgrade on March 17, 2021. They likely are dormant for a while in general because again, these are long-term holders. They're fully swept. They're swept with a fee that typically most of these patterns um have dramatically exceeded the medium fee rate, right? Attackers, they'll overpay for fees to get the the coins and they have other transaction fingerprints. I saw all of that at the chain tip last night. Um, and in the me pool and that's why I flagged that. You know, it there can there definitely are some false positives in there. Um, we need some victim reports to really help us

confirm. The last thing I'll say, which I haven't yet really reported, but I will um on X sometime tonight, there are like 14 other identifiable patterns that we have found that do not appear related to any of those waves, but do have verifiable victims identified because victims have come forth and then I've looked at the patterns and behavior of their attackers and found several others or at least one other, right? So more than one instance, you know, those are literally footprints A through L that I'm calling them at the moment. I think N actually now um those have crept up the count. While we may not be able to yet extrapolate like a giant amount to

each of them, um they are confirmed victims. And so um you know, we've been saying I think the last numbers we put out were near,400 Bitcoin yesterday at the end of wave three. If you add the amount, um, you know, we're saying maybe two or three, I think three or 400 in wave four, but I'm not adding that yet. I really do need confirmation. And I encourage victims to DM me on Hex. I've been diligently helping people for several days now, not just cataloging it for us, but providing back basically wholesome chain analysis style reports that they can use to report uh to authorities. Um, but I I have it now at, you know, if we include wave four, we're almost at 2,000 Bitcoin. So, we're well

over a hundred million dollars of self-custodied Bitcoin. Um, even without wave four, we're over hund00 million. I would place it more in the 1,600 BTC range. Again, for a distributed self uh custody storage hack, that's unprecedented as far as I'm aware. Um, quite devastating. That's awful. Um, the thing that jumps out at me is that, you know, we operate in this trustless, permissionless environment. And the problem was is that as as trustless and permissionless as you try to be, you have to have trust somewhere.

And they trusted Colt Card to do the right thing. And that's where everything broke down. And so, it's really, really hard. Um hopefully, you know, there's some good things that come out of this, which you hate to even emphasize right now because it's so terrible, but you know, Alex, you're very much in the Bitcoin world. If a high level of of compute allowed people to derive seed phrases, to me, this is a precursor to what Quantum could do, not only in Bitcoin, but across, you know, all of financial services and beyond. So maybe this is a wakeup call um you know for the community to really focus on these high compute threats. Um >> yeah you agree with that?

>> Um I do. I of course the threats are a little different. Um yeah but you know they're they're not they're really not that different right? I mean if you had substantially you know um industry standard entropy you're not affected here but you could be you know because the world's GPUs combined probably couldn't break it but that you know you're talking about multiple step function increases in the case of quantum they might be able to derive uh seeds across that whole space that's the fear um I think this you could call it a trial run perhaps if quantum does emerge it wouldn't look that different right because the attacker this is one thing that's going to be tough with the recovery if it can happen. How does the victim prove their ownership, right?

Like um the attackers have their keys, right? So it can't be solely by a cryptographic proof. Um that's why we're encouraging people to make um uh you know wholesome formal victim respon uh filings and reports to FBI's, IC3, their local police to establish their victimhood and keep the cold card device. Don't use it necessarily. don't use it, but keep it because it could be evidence that shows that you did act you actually were the one that first had the keys. Um, you know, I think another point worth raising is that it it's not just the cryptography or the generation of the keys that's an issue. Um, AI is of course across other domains as well

are finding substantial codebase issues all over the world right now. There's a red team uh of Bitcoin security engineers working as we speak and for days um unfortunately forced to use like Kimmy and GLM and not Frontier US models which won't allow this type of cyber work um literally going over every hardware wallet codebase every open- source library that's used in crypto and in Bitcoin fulsomely to try to uh patch and and you know fight back against what is becoming an increasingly dangerous threat environment. Um, that work is ongoing.

>> If you like this segment, please like, subscribe, and tune in every Monday at 4:30 p.m. Eastern time. I'm Austin Campbell, the host of Bips and Bips, along with my friends Ram Alawalia and Chris Perkins, and our slate of exceptional guests. Every week, we're going to discuss macro, crypto, and the collision of worlds, covering topics that move markets and shape the financial landscape. >> If you hold crypto on your phone, your biggest vulnerability isn't your wallet. It's your carrier. AT&T, Verizon, and T-Mobile have been breached again and again, and SIM swaps are still one of the easiest ways for attackers to drain accounts. That's where Cape comes in.

America's privacy first mobile carrier. Same premium service, but Cape rotates the identifier on your SIM every 24 hours, deletes your call and text metadata after a day, and protects against SIM swaps with a 24word recovery phrase that only you control. You also get two middle toend encrypted secondary numbers for banking and signups, so you stop handing your real number to every app that asks. Go to cape.co/chained co/chained and use code unchained for 33% off your first six months.