WHITE HAT DRAINS OF COLDCARD WALLETS BEGIN

The white hat wallet drains of exploitable COLDCARD wallets are now underway, according to @coinjoined

If your COLDCARD was compromised, do not destroy the device. It could be needed if a recovery process is established.

If a white hat secures your coins before you move them yourself, any future claim may depend on proving ownership with your device and KYC records.

Users without a way to verify ownership could face a much harder path to recovery.

Link: https://www.ledger.com/blog-coldcard-incident

TL;DR
Ledger explains that the recent Coldcard incident was caused by a firmware bug that weakened the randomness used to generate recovery seeds, making some seed phrases predictable to attackers.

Updating the firmware alone is not enough if your wallet was initialized with affected firmware. Users must generate a brand-new seed phrase and move their funds to a new wallet. Reusing the old seed on another device does not fix the issue.
Ledger says this vulnerability is specific to the affected Coldcard firmware and does not affect Ledger devices.

The incident is a reminder that secure seed generation is critical for any hardware wallet, and users should keep firmware up to date and follow good security practices.

This is a tough week for bitcoin community. Wishing speedy recovery of funds for everyone involved.

Lessons learned for the rest:

1. Hardware wallets - were always a vector of a possible attack. Just like you can't trust 100% your ISP, your PC and your phone, same goes for hardware wallet.

2. To protect yourself, always use a passphrase. It makes these kinds of exploits million times more difficult, if not impossible.

3. If you have any significant funds, you must have a passphrase. If you don't, you haven't done your homework.

4. Coldcard is the only wallet that was impacted by the seed-generation issue, you are perfectly fine if you didn't create a seed on Coldcard. Trezor, Ledger and other wallets don't share the same firmware as Coldcard.

5. I wouldn't recommend Coldcard at this point but the device itself, as far as we know, is still perfectly fine but you need to realize that company is most likely going out of business, so won't be getting much support or updates from them after this.

6. Apple, Microsoft, Meta, Oracle and other firms had bugs in their code that allowed people to steal stuff. Coinkite had a bug in the code as well that allowed a nasty exploit. Bitcoin doesn't have a bug in its code.

7. Self-custody is not for everyone. If it is easier for you to let someone else manage keys, you can/should explore those options. But companies and governments fail and it happened many times in the past as well, so nothing in life is 100% guaranteed.

Needing to set up a cold wallet. Any advice of what to be looking for?

Hello, I have an mk3 which I haven’t touched since like 5 years and would like to move my funds to a different wallet. I have created the seedphrase with dice rolls but I don’t remember how many times I rolled and I also added a passphrase. I feel like I forgot everything about how to use the coldcard. Can someone give me a guide what should I do, especially if my cc was not “touched” since the first time I moved my funds there ?

Curious how you guys here approach sending larger amounts of BTC between your own wallets. Do you split it into smaller transactions? Use a specific type of wallet for the receiving side? Double-check everything multiple times? Or just send it normally and accept the risk?

Always interested in hearing how experienced people reduce the chance of mistakes when the amount actually matters.