Coldcard 钱包熵漏洞致 600 枚比特币被盗，单签用户被警告立即转移资金

Three big reasons why Bitcoin dipped today. Many people are saying this is the dump before the pump, especially with there being renewed hope on the horizon with the Clarity Act.

We're talking about blockchain. A number of the banks that have been investing will be big winners in this.

But, in the short term, some things couldn't be worse. People are losing a lot of money. A dark day for Bitcoin self-custody today.

I researched a lot, and this was like the best way to store your Bitcoin. Everybody and their mother would swear by this.

If you know somebody who self-custodies their Bitcoin, send them this video today. I'm going to go over it because you still have a chance to save your Bitcoin. Altcoin Daily keeps you informed on everything crypto everyday. So, smash the like button if you appreciate us not taking the summer off. Let's start here. We posted this warning on X very quickly as the information was breaking. So, again, make sure you follow us on X.

Takes us hours to make a YouTube video. It takes us seconds to update you on X. Now, this is what you need to know. A prominent Bitcoin self-custody cold wallet company called Coldcard, many wallets are being drained. Thus far, 600 Bitcoin or $38 million has been stolen from dormant single sig wallets. Send this to somebody who uses Coldcard. Now, not every Coldcard is affected, but you are probably at risk if you generated a single key wallet on Coldcard between 2021 and 2023.

If you didn't do multi-sig, if you didn't do a passphrase, if you didn't roll the dice, I'll explain more on that in just a second, you are at risk, and you should move your funds immediately. The cause of this is being called an entropy bug from a 2021 firmware rewrite that had to do with seed generation. Note, this does not affect Ledger, this does not affect Trezor, this does not affect any other hardware wallet. Stay calm, rushed moves create openings for scammers.

But yes, if you've never heard of Coldcard or never used a Coldcard, it is because Coldcard is a rather niche self-custody solution built by Bitcoin maxis with a community of Bitcoin maxis. Coldcard was actually known as a blue chip in the Bitcoin OG Bitcoin maxi space for self-custody. Our hearts go out to anyone who lost money because we have seen stories Bitcoin maxis are losing their life savings because of a very stupid mistake by Coldcard.

So, tensions are high today. A lot of prominent individuals in the Bitcoin space are coming out and sharing their story.

I'm shocked too because I'm shocked because I researched a lot and this was like the best way to store your Bitcoin. Everybody and their mother would swear by this. And for it to be hacked, like you really need to be like in the head. So, yeah, like stay safe out there, guys. You can't even trust anybody. Like right now, I'm thinking like what what's next? Like what am I even going to do? Like can I even trust anything?

So, let's put what happened in plain simple English. The code for Coldcard had a safety check to confirm that real randomness was in use, but the check only asked, "Does this setting exist, but not is it turned on?" And that setting was off. So, the wallets made keys, seed phrases, from fake randomness, and fake randomness can be guessed. Again, this only happened to Coldcard. This was perhaps the number one most recommended Bitcoin self-custody solution in the Bitcoin OG maxi community.

Many are coming out and saying, "What happened here is negligence, plain and simple, a vulnerability sitting in firmware since 2021. I'm crushed for everyone affected. I've been recommending Coldcard for years now, but just know I've moved everything. Again, you could have avoided this mistake with this particular product if you would have rolled the dice. For those who took the time to roll 100 dice or one dice 100 times, your Bitcoin is safe."

So, the first advanced feature I'd like to cover on the Coldcard is creating a seed phrase with entropy via dice. And on the the Coinkite website, you can actually pick up these little bags of of dice, uh so that you can basically do a whole bunch of rolls all at once, and then input these dice rolls to add entropy to the creation of your seed phrase. Basically, what this is used for is if you don't trust Coldcard or Coinkite to generate a seed phrase for you that can't be replicated, then you can inject all of this other data into it and change the seed phrase with each new data point that you input.

And you can replicate this and prove that the entropy actually did its job.

Bitcoin self-custody doesn't really seem ready for primetime if the only way you could have avoided this is rolling 100 dice. And this is what's really crazy about this exploit and why it's not a normal exploit we typically see. What's crazy about this Coldcard attack is that it doesn't really seem like there's a clear way to responsibly disclose this. Think about it. Unlike normal vulnerabilities where you can patch the software quietly in the background and let at least some portion of the ecosystem upgrade, in this case, it doesn't matter if you upgraded since the issue is at the point in time of the seed generation.

What's even worse is that with self-custody setups in many cases, you can't reliably inform impacted customers. Either fake contact information is submitted at purchase, records are deleted not stored for privacy, or the company can't know where the expub or Bitcoin wallet came from. You also have no way to know when seeds were generated and with what firmware. But by the way, Coldcard didn't keep user data anyway. They didn't have an email list to alert their customers.

But even if they did, think about this. This is a scary thought experiment. If Coldcard had found this exploit themselves, how could they have fixed it without instantly putting all of their customers' coins at risk? Patching the firmware wouldn't fix vulnerable seeds. And the moment they emailed customers, assuming they hadn't purged records which they did, or released the patched firmware, this would have alerted hackers to the exploit and began draining wallets.

One of the only ways to have saved vulnerable coins would have been to alert a white hat group before any public disclosure who could have preemptively seized vulnerable coins and then let people provide non-cryptographic proof of ownership, which would have been a complete mess, invited massive lawsuits, and likely an impossible task unless they used a KYC exchange before to purchase the coins, in which case you could maybe prove a linkage.

Isn't that crazy? So, the bigger headline here is that the first attacker seemed slightly unsophisticated, probably stumbled upon this exploit using AI, isn't sweeping all the coins in the wallets, etc. But, now that the exploit is known, other professional attackers will be coming quickly and cleaning house. You do not have time. Move your coins now. Multi-sig if you have the equipment/time. Send them to an exchange temporarily if you don't.

Hate to say it, but that's the reality. Again, the OG Bitcoin maxi community is reeling from this. A dark day for them, but also a dark day for self-custody. It's going to be hard to recommend and it's going to be hard for new people to choose self-custody when things like this happen. Truly a dark, dark day for self-custody, especially with it seeming like a disproportionate amount of OG Bitcoin believers are affected.

But, even with that hack exploit, I personally think that has a small effect on today's price action because really the industry has been largely moving away from self-custody since about 2024. Probably the most obvious reason why Bitcoin is dipping today is because the bond market is out of control. The US 30-year yield is now up to 5.27%, its highest level since June of 2007. Even without rate hikes or Fed guidance, the market is sending rates higher, operating exactly how Fed Chair Warsh wants it to operate.

Also, despite h

原文超出正文长度上限，此处截断——上游还有内容，完整版见上方「原文 ↗」。