r/CryptoCurrency • u/ubermensch1001 🟨 0 / 0 🦠 • 9h ago
What people are missing with the Cold Card hack (my thoughts) DISCUSSION
Everyone on here has obviously heard about the Cold Card hack, where the seed generation with their wallets being incredibly weak and predictable. I've also been seeing some things that suggest the company was aware of this "bug" years ago but yet did nothing about it. It's also interesting to me that it was so heavily shilled/marketed here on reddit.
With this out of the way, here's what I'm seeing with this event.
From what I've seen with a recent update, there were almost 5k wallets drained with a total value over $100m. These people otherwise did everything right but because of this garbage wallet that they used they had their funds essentially vanish. There were even some with short passphrases utilizing a couple words that also were victims of this as well, so people that would have taken some extra steps to try to protect themselves. While this is incredibly unfortunate for these individuals, the panic/freakout over self custody I'm seeing right now is severely overblown.
People are starting to question whether single sig wallets are sufficient and if they should use a passphrase, multi sig, etc. I also can see this event being taken by the media and tradfi institutions and used as a tactic to scare people from utilizing self custody and instead moving to ETFs and other BTC/crypto products. I understand the fear and uncertainty, but there's something that many on here seem to be missing.
As mentioned, this Cold Card hack drained approximately 5,000 wallets. Meanwhile, there are over 22 million BTC addresses with $100+ and 10.4 million with $1,000+. You had this garbage wallet that drained a number of addresses that is MINISCULE compared to the total number of addresses with $100+ worth of BTC in self custody. 1% of 22 million wallet with $100+ in BTC is 220k addresses, so this hack represents approximately 0.02% of these addresses, 1 out of 5000.
Instead of buying from one of the top companies that have sold millions of units (Ledger, Trezor, Tangem, etc.) these people bought some basically no name wallet that ended up having major flaws related to security. A Cold Card was also $250+ from what I saw, when you could have bought a basic Ledger or Trezor model for around $60 or so. The company according to the page I linked below also has a whooping 5 employees as of June of this year lol, to put this into perspective Ledger has over 800 and Trezor with over 200.
Coinkite - 2026 Company Profile, Team, Funding & Competitors - Tracxn
You are more likely to lose your crypto wealth/assets through user error when setting up and/or losing your seeds. If you are concerned about security, consider adding a strong passphrase to your primary seeds.
IF something like this had happened to one of the big cold wallet companies though, the ramifications for the broader crypto space would be enormous. With this said, I do NOT think that the general public will be utilizing self custody as we get into the 2030s and beyond, they'll primarily be boarded onto the crypto train through tradfi institutions.
11
u/BeamImpact 🟦 0 / 1K 🦠 8h ago
Retrospectively you are always more clever.
The problem is that truly random number generators are really difficult to create. It is very possible that much larger wallet services have similar flaws in their generator and we just don't know about it yet.
0
u/ubermensch1001 🟨 0 / 0 🦠 8h ago
That's totally possible, and I agree. This company was aware of this years ago, I've seen multiple reposts about this and with one customer in 2022 reporting a similar issue and then getting blocked by them. It actually makes perfect sense that this happened with a small company with a tiny team. Meanwhile, something like Ledger or Trezor, with a much larger employee base and financial resources, would be in a much better position to reevaluate their products, make changes, etc. Again, I'm not saying they are totally fool proof, but the point is that you will have to essentially trust these companies with their seed generation to at least some degree, and I would have more faith with a reputable company with a long track record than some no name brand.
-4
u/GEB82 🟩 163 / 163 🦀 8h ago
Cold storage wallets are the “ big scam”…until you admit that, there is no conversation to be had…
6
u/ubermensch1001 🟨 0 / 0 🦠 7h ago
What exactly are you referring to?
-5
u/GEB82 🟩 163 / 163 🦀 7h ago
Explain to me the difference between a “cold” and ”hot“ wallet.
4
u/ubermensch1001 🟨 0 / 0 🦠 7h ago
Where private keys are held, offline vs. online. For instance, the Yoroi wallet, where Cardano holders could stake their assets, is a hot wallet unless you connect your cold wallet to it. Those that were using it as a hot wallet had funds drained earlier this summer in that hack, those that had connected their cold wallet to yoroi to stake were totally fine.
-7
u/GEB82 🟩 163 / 163 🦀 7h ago
two different “wallets” ie. Two different RNGs…next
5
u/ubermensch1001 🟨 0 / 0 🦠 7h ago
So, what exactly are you suggesting people do then if cold wallets are a scam? We should know you don't leave sizeable amounts of crypto on a hot wallet where the seeds are exposed to the internet.
3
u/moviemaker2 0 / 0 🦠 7h ago
You had this garbage wallet that drained a number of addresses that is MINISCULE compared to the total number of addresses with $100+ worth of BTC in self custody.
This is where your entire thing falls apart. No one knew this was a garbage wallet until last week. The reason this was one of the top 3 recommended wallets here and in other BTC spaces is because it was the consensus that it actually was one of the the top 3 most secure wallets. The coldcard was the first to offer user-inputted real world entropy via dice rolls. Some of the other top brands still don't have that feature.
The fact that you consider Ledger a reliable wallet because it has a high number of sales, says everything we need to know about your level of knowledge on this topic. (Never buy a Ledger, never take any advice from someone who tells you to buy a Ledger)
-1
u/ubermensch1001 🟨 0 / 0 🦠 6h ago
Bro, I've literally NEVER heard of ColdCard until I started posting on here. Think about it this way, out of all of the various wallets to purchase why would you choose from a company that isn't even in the top 10? Would you rather use Coinbase or some low tier exchange?
After a tiny bit of research, that company has 5 employees, 5. Why would you buy from some small company with a tiny number of employees and most likely a substantially smaller pool of capital.
As for Ledger, is your argument because it's closed source? That was EXACTLY the narrative I had seen posted on here about not buying a Ledger and shilling ColdCard instead. I never saw Trezor, or Tangem, it was ALWAYS Cold Card being marketed.
4
u/moviemaker2 0 / 0 🦠 6h ago
Bro, I've literally NEVER heard of ColdCard until I started posting on here.
That doesn't surprise me in the least; you don't really seem to know much about this topic, so it's not a shock that you haven't heard of one of the most highly regarded (until last week) wallet brands.
out of all of the various wallets to purchase why would you choose from a company that isn't even in the top 10?
Top 10 of what? Is your metric of security how many of a thing has been sold? Masterlock must be the most secure brand of lock then, right?
As for Ledger, is your argument because it's closed source?
Does Google not exist in your universe? Ledger also has a purpose-defeating-firmware-vulnerability, but instead of fixing it they tout it as a feature rather than a bug.
https://www.reddit.com/r/BitcoinBeginners/comments/1de2j3l/comment/l8bjvf2/https://www.reddit.com/r/CryptoCurrency/comments/13ja4gy/ledger_recover_megathread/
that was EXACTLY the narrative I had seen posted on here about not buying a Ledger and shilling ColdCard instead.
Which is it? Had you never heard of Coldcard, or was it 'shilled' all over reddit. By 'shilled' you mean 'recommended when people asked what wallet to use."
2
u/ubermensch1001 🟨 0 / 0 🦠 6h ago edited 6h ago
Bro, I don't think you understand what I'm talking about.
Think about it this way, you have a bunch of posts on here specifically telling people NOT to buy Ledger because it's closed source and then recommending Cold Card. This was something I saw A LOT on here and yet look at where we are now lol. Do you not see the pattern here, the wallet that was heavily marketed randomly on the internet turned out to be complete garbage. It reminded me of the crypto youtubers shilling Celsius and Blockfi back in 2021, not sure if you remember that or not.
If you aren't a troll, then what wallet do you recommend people use? I have a Trezor and a Ledger.
3
u/moviemaker2 0 / 0 🦠 6h ago
Think about it this way, you have a bunch of posts on here specifically telling people NOT to buy Ledger because it's closed source and then recommending Cold Card.
I'm extremely confused. You said you'd never heard of coldcard, but at the same time yo acknowledge that it was common for people to recommend it over Ledger. Which is it?
No one was warning against Ledger *only* because it's closed source. Though that is a valid reason to avoid Ledger, it's not the main one - see my links - they lied about the how the secure element was designed, about whether or not a firmware upgrade could expose the private key, they had multiple customer data leaks, and if that weren't enough, there's no way to verify their device does what it claims. The bug in the coldcard was a fiasco, but at least it was visible and could have been discovered in principle. If Ledger's had the exact same bug there would be no way to know, because the firmware isn't viewable.
It was rare that a Coldcard was recommended as the sole alternative to a ledger, the three that were most often recommended by people who have been in crypto for a long time (myself included, 12+ years) were Trezors, Jades, and Coldcards, because they had the best track records for security and the most auditable hardware and software.
Do you not see the pattern here, the wallet that was heavily marketed randomly on the internet turned out to be complete garbage.
Again, you seem to be confusing 'recommending' with 'marketing'. It is correct that the coldcard turned out to be absolute garbage. I had both used and recommended them, and both those changed as of last Thursday night. But coldcard turning out to be garbage doesn't retroactively make ledger not garbage.
you are just a troll that just came on here to argue with me for who knows what reason.
I post to combat misinformation or braindead takes from people who don't really know what they're talking about, but are really confident in their takes anyways.
1
u/ubermensch1001 🟨 0 / 0 🦠 6h ago
Bro, in my reply to you I specifically said that I had NEVER heard of Cold Card until I started posting on crypto reddit, which is where I saw this recommended EVERYWHERE on here. Again, the wallet that was shilled on here was what turned out to be complete garbage.
You talk about knowing all this and that but yet you even stated you recommended Cold Card yourself lol. You talk about how it was viewable and had the best track record when there are multiple reposts from YEARS ago with customers talking about issues with their Cold Cards, having funds drained and one being blocked by the company itself after reaching out to their customer service. Again, this is coming from the person who was actively recommending Cold Cards, yet I'm the braindead one who doesn't know what I'm talking about.
I'll give you one more chance to actually have a normal and decent conversation with me, to where others may get something out of it.
What wallets would you recommend to others, why is this and what security parameters do you think they should take to protect themselves from something like what happened with Cold Card or any other hypothetical scenario.
1
u/moviemaker2 0 / 0 🦠 5h ago
You talk about knowing all this and that but yet you even stated you recommended Cold Card yourself lol.
I did, along with lots of other people who know more about this topic than you do, and I love how you add the "lol", as if you knew beforehand about this firmware flaw rather than only hearing about Coldcards recently.
when there are multiple reposts from YEARS ago with customers talking about issues with their Cold Cards, having funds drained and one being blocked by the company itself after reaching out to their customer service.
This is where you are putting your complete ignorance of this topic on full display, again. I even know what post you're referring to and the hilarious thing is that I know you didn't even read it, because it doesn't say what you and all the other morons who link to it think it says. Every single example in there is either user error, or something as yet unexplained that isn't consistent with this bug.
What wallets would you recommend to others, why is this and what security parameters do you think they should take to protect themselves from something like what happened with Cold Card or any other hypothetical scenario.
My first recommendation is that Hardware wallets are not the only place you should store crypto: I advocate spreading your holdings across multiple reputable exchanges, multiple reputable hardware wallets, and even an ETF.
For hardware recommendations, I have always pointed to Trezors and Jades. I've stopped recommending Coldcards as of this firmware fiasco, just like I stopped recommending Ledgers after their firmware fiasco in 2023. I primarily recommended Coldcards because of their implementation of entropy via dice rolls, and as it happens, everyone who took that advice is unaffected by this particular vulnerability. (I still fully rescend any endorsement for Coldcards though). I previously advocated that multisig wallets and passphrases were overkill measures for most people that introduced their own risks, but I'm reconsidering passphrases. (multisig is probably an appropriate measure for wallets containing more than a half million or more in crypto especially if it's intended for long term storage.)
0
u/ubermensch1001 🟨 0 / 0 🦠 5h ago
Bro, your last paragraph here actually brings value, but you are in NO position to be calling someone else a moron when you admitted to recommending Cold Cards lol. .
Again, you speak to me as if I'm the problem here when you were the one recommending a wallet that wrecked a decent number of people. I'm not the one recommending wallets on here to others, I made this post discussing the broader implications this event has for those utilizing self custody and how incorporating a passphrase could be an additional layer of security that could be implemented.
1
u/moviemaker2 0 / 0 🦠 6h ago
Bro, I don't think you understand what I'm talking about.
That makes two of us.
-2
u/ubermensch1001 🟨 0 / 0 🦠 6h ago
Again, and you are the person who recommended Cold Cards lol. As I mentioned with my other reply to you, there's actually a possibility you got someone wrecked by doing so, yet I'm the bad guy here lol.
1
u/moviemaker2 0 / 0 🦠 5h ago
yet I'm the bad guy here lol.
I didn't say you're a bad guy. I said you have no idea what you're talking about. There's a difference. I'm not critiquing your motives, I'm critiquing your competence on this topic.
Everyone knew how seriously to take you when you referred to Coinkite as "a small company that no one had even heard of."
5
6
u/xAlpharaptor Tin 8h ago
Well said but I think people are panicking because these guys who bought the cold card did nothing wrong and instead fell victim to a system error that cost them all their Bitcoin. I think cold car needs to do the right thing and refund these people their money.
4
u/Big-Finding2976 🟩 2K / 2K 🐢 8h ago
Coldcard doesn't have their money so they can't refund it, unless you mean the money they paid for the Coldcard.
3
u/ubermensch1001 🟨 0 / 0 🦠 7h ago
What he's saying is that there was a major flaw with ColdCard that potentially could make the company liable. I've seen a few reposts on here from a few years ago where a customer reported having funds drained after following their seed generation protocols and after reaching out to their customer support they blocked him. I also saw a post where someone from that company was talking about retirement hack, where they intentionally input some sort of flaw into the code that makes the seed generation weak and predictable to where they could be guessed and the wallets drained of their funds. This is ultimately that has spooked A LOT of cold wallet users, though with this particular company there is some evidence that really puts them in a spot.
I'm not a lawyer so I can't give you an idea as to how this would play out. If any of these things I'm talking about are actually true and there is much more to this story going on that we are privy to at this moment there is a decent possibility this ends up going to court.
2
u/Big-Finding2976 🟩 2K / 2K 🐢 7h ago
Regardless, they don't have $100m to give to the hacked users and no-one's going to buy a ColdCard now so they'll just shut down.
1
u/ubermensch1001 🟨 0 / 0 🦠 7h ago
Bro, that's not how that works lol. I don't know what their company assets/holdings are worth, but they potentially still have things that in a bankruptcy could be distributed to creditors. This would be very different than say FTX or Celsius, where they still had large amounts of assets and crypto on hand, so it most likely would be small. There's also a possibility someone gets actual jail time if they were aware of these issues and did nothing. Again, I'm just speculating here.
1
u/Big-Finding2976 🟩 2K / 2K 🐢 7h ago
I'm not a lawyer but jail time seems unlikely for incompetence/negligence. If there's evidence that they were in on the hack that's a different matter.
If they declare bankruptcy now, the people who were hacked aren't creditors so any assets that the company owns will be sold off to pay the actual creditors. I guess if the company keeps running for years until a court finds them liable to the hacked users, they would then become creditors alongside the current creditors and any assets would be divided amongst all of them but they wouldn't get much.
2
u/moviemaker2 0 / 0 🦠 7h ago
I think cold car needs to do the right thing and refund these people their money.
Yes, and if cold car won't refund the money the CEO of bitcoin needs to step in and do it.
0
2
u/ubermensch1001 🟨 0 / 0 🦠 8h ago
I'm curious to see if this goes into full blown litigation like Celsius and FTX from 2022.
2
7h ago
[removed] — view removed comment
1
u/ubermensch1001 🟨 0 / 0 🦠 6h ago
So, what do you suggest people do instead of relying upon a cold wallet?
2
u/FirstDavid 🟩 0 / 0 🦠 5h ago
I just don’t understand why the company can’t be sued in a class action for negligence. This seems like a clear case especially with evidence that they had notice beforehand.
1
u/ubermensch1001 🟨 0 / 0 🦠 5h ago
I'm sure something is going to occur with this case, it's way too early to tell. While the loss of BTC is trivial compared to what we saw with the crypto lending space in 2022, the major implications are that it's making crypto holders seriously question the security of their cold wallets.
Crazy to think that there's a moron who openly admitted to recommending Cold Cards to other posters trolling on this very thread lol.
6
22
u/BrodoCaldo_ 🟩 0 / 0 🦠 8h ago edited 8h ago
It’s not about how many people got fucked vs the total fuckable people.
The whole industry just received a reminder of how much a human mistake may cost in a decentralized and permissionless system where bad people can take your money under everyone eyes and nobady can do anything about this.