The Coldcard Exploit What Happened & Why Bitcoin is Stronger Than Ever
summary
Explains how a five‑year‑old firmware bug effectively disables the RNG, producing 22‑bit entropy seeds and enabling the theft of about 1,800 BTC; traces the exploit through public commits, unusual transaction patterns, and sloppy code maintenance with no bug bounty or audit. Demonstrates that multi‑vendor multi‑sig setups (and tools like Lyanna) would have prevented mass loss, and recommends continuous AI-enabled code audits and concrete processes (commit reviews, checklists, bounties) to harden hardware‑wallet security.
AI-written summary · about
chapters (9)
- 0:00Start
- 2:30How the Coldcard Entropy Bug Was First Discovered
- 5:00The Failure of Code Maintenance and Crisis Management
- 7:44Breaking Down the Random Number Generator Error
- 10:49Why Multi-Vendor Multi-Sig Protected Users
- 14:00The Reality of Hardware Wallet User Adoption
- 17:23Custodial Risks vs Hardware Wallet Vulnerabilities
- 20:49How AI Will Change Bitcoin Code Auditing
- 24:19The Importance of Open Source and Bug Bounties
related talks
44mCryptography Pitfalls
29mSecurity of Cryptocurrency wallets/mining
18mEngineering a backdoored bitcoin wallet
40mBlockchain Security Guarantees and Exploits
38mExtracting Seeds from Hardware Wallets
49mAttacking and Defending Blockchains: From Horror Stories to Secure Wallets
15mTrust No One: Custodianship And The Importance Of Securing Digital Assets
49mAttacking and Defending Blockchains: From Horror Stories to Secure Wallets