Galaxy Research Coldcard hack update: 1,158.81 BTC stolen from 2,673 addresses

Posted by paulpauper 1 day ago

Counter18Comment6OpenOriginal

Comments

Comment by ifwinterco 21 hours ago

This is a bad one: bug in the RNG logic during seed generation, so you can lose funds easily without any action from the user and the device never connected to the internet.

I still think crypto is unfairly maligned and will be more significant in the coming decades than most people think, but the fact it's almost impossible to do self custody safely and statistically you're less likely to lose funds just having them on Coinbase or Kraken (aka in a bank) is pretty damning

Comment by 84adam 20 hours ago

> it's almost impossible to do self custody safely

The main problem here, I think, is that Coldcard (Coinkite) was one of the largest and most heavily promoted hardware wallets in the space. Many of the top influencers promoted them. And the bug in RNG was actually introduced inadvertently in an effort by Coinkite to move the firmware away from an open source license to a 'source viewable' license.

None of the other hardware wallet manufacturers introduced this class of bug into their firmware.

In-depth review of other solutions being done by many in the community now, of course. E.g.: https://xcancel.com/bitcoinsbanker/status/208361209471318024...

Comment by ifwinterco 20 hours ago

Yep and red flags were there in hindsight, but everyone ignored them.

I think the brutal truth for maxis is that coldcard was promoted by them because of coinkite’s bitcoin-only stance and there was no actual assessment of whether the team or the product was made with the care needed.

Anyone who hates “shitcoins” must be a thoughtful, conscientious person right?

Well no, as it turns out

Comment by 20 hours ago

Comment by paulpauper 1 day ago

It will be interesting to see how the hacker(s) move the funds. All eyes are on those addresses .

Comment by dnemmers 1 day ago

Easiest move would be donate to political entity, it'll buy you plenty of jail cover.

Comment by x______________ 23 hours ago

Someone did this recently in Czechia, to the department of Justice, got caught. [0]

https://en.wikipedia.org/wiki/2025_Czech_government_Bitcoin_...