COLDCARD SECURITY RISK: IMMEDIATE ACTION REQUIRED

An important story is making waves across the blockchain ecosystem. Bitcoin Magazine COLDCARD SECURITY RISK: IMMEDIATE ACTION REQUIRED First, yes, that is a very clickbait title and completely unusual. This is a real security issue. Here is the official announcement from Coinkite themselves posted yesterday, please read and verify the genuineness of the issue there.

TLDR: Coldcard MK2, MK3, MK4, MK5 and Q are being drained. A bug lets attackers find your seed phrase without any action on your part. Only wallets generated using the dice roll method are safe, assuming you rolled at least 50 dice.

Market Dynamics

If you don’t know, don’t remember, or aren’t sure, move your funds immediately. This is a critical issue that requires immediate action. If you used a Coldcard to generate a word seed and did NOT use the recommended 50+ dice rolls to provide your own entropy after the end of 2020, your word seed is not secure.

It was generated without a sufficient amount of randomness, and can be brute forced by a malicious attacker. Wallets are actively being drained now. This issue also affects any ephemeral keys and session keys for Clone Coldcard or Key Teleport features, and BIP 85 seeds generated from a compromised seed.

YOU MUST STILL MOVE YOUR FUNDS. This attack is being actively exploited, with around 1000 BTC seen moving on-chain connected to the vulnerability. You must move your funds to a new word seed, or a word seed generated by a different device, in order to secure your funds.

Market Impact

– If you have another hardware wallet that is not a Coldcard, send your funds there. This is the quickest and simplest way to get them someplace secure. – If you do not have another hardware wallet, and only have a Coldcard, generate a passphrase using at MINIMUM six seed words from the BIP 39 word list.

Use this guide to select your words for the passphrase, do NOT pick them yourself. Check your wallet fingerprint (or an address), power down your device, restart it and re-enter the passphrase. Confirm that the fingerprint (or address) matches, and send your funds to the passphrase wallet.

This is not a permanent solution. This is simply giving you enough security that an attacker will not be able to brute force your keys in a matter of days, and you can generate a new seed without being in a state of panic. Make sure your passphrase is written down securely.

Crypto markets are watching this development closely as investors weigh its potential impact on prices.