Inside the Coldcard Hack That Drained Over $100 Million in Bitcoin: Uneasy Money
Inside the Coldcard Hack That Drained Over $100 Million in Bitcoin: Uneasy Money
1 hour ago•Unchained•Laura Shin
Podcast1 hr 6 min
Listen to Episode
Note: AI-generated summary based on third-party content. Not financial advice. Read more.
Quick Insights

If you or anyone you know uses a Coldcard hardware wallet, you must immediately move your Bitcoin (BTC) to a secure, unaffected wallet due to a major entropy vulnerability. Thoroughly evaluate the security practices and audit histories of all self-custody wallet providers before storing your digital assets. Keep a close eye on Ethereum governance proposals like EIP-8361, as upcoming changes to network issuance could significantly alter Ethereum (ETH) staking yields. Anticipate potential market volatility for ETH if low staking yields trigger massive unstaking and selling pressure. Always prioritize rigorous due diligence and proactive risk management when navigating rapidly evolving cryptocurrency infrastructure.

Detailed Analysis

Bitcoin (BTC)

  • A massive hardware wallet vulnerability involving the Coldcard wallet was discovered, resulting in over $100 million in stolen funds (approximately 1,600 to 1,800 Bitcoin) across thousands of addresses and victims.
  • The vulnerability stems from a 5-year-old entropy (randomness) generation bug in the Coldcard codebase that allowed attackers to use massive computing power and GPUs to mine and crack private keys.
  • Because Coldcard did not store user data (a privacy feature), the company had no way to directly notify or warn users to move their funds, leading to an ongoing series of attacks categorized into multiple distinct waves.
  • Security experts advise that hardware wallet users should check their provider's security audit history and development practices, and note that offline entropy methods like dice rolling require high repetition (50+ rolls) to be secure.

Takeaways

  • Check if you or anyone you know uses a Coldcard hardware wallet, and immediately move funds to a secure, unaffected wallet if applicable.
  • Evaluate the security practices, code review processes, and audit histories of any hardware or software wallet provider before trusting them with self-custody assets.

Ethereum (ETH)

  • Ethereum is facing internal governance debates surrounding a controversial proposal (EIP-8361) that aims to reduce ETH issuance, with critics arguing it was rushed with inadequate industry consultation.
  • Opponents of the proposal raise concerns that lowering staking yields to extremely low levels could cause tens of billions of dollars of ETH to be unstaked and dumped onto the market, potentially harming the asset's price and reducing network security by discouraging solo stakers.
  • Conversely, some participants note that increased decentralization and public debate around monetary policy signal a shift away from a rigid monoculture toward a more active, participatory governance ecosystem.

Takeaways

  • Monitor Ethereum governance proposals like EIP-8361, as changes to monetary policy and staking issuance can materially impact staking yields, liquid staking tokens (LSTs), and overall network security.
Ask about this postAnswers are grounded in this post's content.
Episode Description
A hardware wallet's 5-year-old randomness bug just let hackers drain over $100 million in Bitcoin. How many more waves are coming? Plus, Ethereum's fight over cutting ETH issuance. ======================================================== Thank you to our sponsors! ⁠⁠⁠⁠⁠⁠Cape⁠⁠⁠⁠⁠: Your biggest crypto vulnerability isn't your wallet, it's your phone number. Cape is America's privacy-first mobile carrier that rotates your SIM identity daily and blocks SIM swaps before they happen. Get 33% off your first six months at ⁠https://cape.co/unchained⁠ (use code: UNCHAINED). ======================================================== A firmware randomness bug buried in Coldcard's code since 2021 surfaced last week and has already drained over $100 million, an estimated 1,600 to 1,800 Bitcoin, across four attacker waves. Taylor Monahan makes the case that the culprit is not North Korea but professional GPU crackers, and explains why the dice-rolling ritual many early victims trusted still left them exposed. Sonya Kim, co-founder of 3F Labs, and Mike Silagadze, founder and CEO of ether.fi, debate where DeFi's responsibility ends after trade.xyz's SK Hynix perp swung from $1,128 to $917 on a thin premarket print, then turn to Ethereum's own monetary policy fight. That fight centers on EIP-8361, a proposal to cut ETH issuance that opened with only 48 hours for public comment, reviving the minimum viable issuance debate Sonya once worked through at Steakhouse. Silagadze calls cutting issuance economically unsound and warns it could push billions of dollars of ETH out of staking, while Kain Warwick argues the resulting chaos is good for an Ethereum governance culture that had grown too quiet. The conversation covers Coldcard's entropy failure, the dice rolls that did not save early victims, trade.xyz's oracle mispricing, and Ethereum's issuance fight. Hosts: ⁠⁠⁠⁠⁠⁠⁠Kain Warwick⁠⁠⁠⁠⁠⁠⁠ - Host of Uneasy Money and Founder of Infinex and Synthetix ⁠⁠⁠⁠⁠⁠⁠Taylor Monahan⁠⁠⁠⁠⁠⁠⁠ - Co-host of Uneasy Money and Security Expert Guest: ⁠⁠⁠⁠⁠⁠⁠⁠Sonya Kim - Co-Founder of 3F Labs ⁠⁠⁠⁠⁠⁠⁠⁠Mike Silagadze - Founder and CEO of Ether.Fi Timestamps 🔓 01:17 Coldcard's 5-year-old entropy bug resurfaces, over $100M in BTC stolen 🕵️ 10:26 Taylor argues it's not North Korea: this hack needs compute, not scams 🎲 21:00 The dice roll debate: why 50 rolls barely saves your seed phrase 📱 27:14 Cape: Get 33% off your first six months with code 'unchained' at https://cape.co/unchained 📉 27:39 SK Hynix oracle glitch on trade.xyz reignites the platform-responsibility fight 🔗 42:24 Aave retreats from multichain sprawl as EIP-8361 issuance fight erupts 🧠 51:26 Mike on why cutting ETH issuance would push billions of dollars of ETH out of staking 🔥 53:05 Sonya's fix: burn fees for the same effect without cutting issuance 🌀 01:05:20 Kain's take: fragmenting the EF into chaos is actually healthy for ETH Learn more about your ad choices. Visit megaphone.fm/adchoices
About Unchained
Unchained

Unchained

By Laura Shin

Crypto assets and blockchain technology are about to transform every trust-based interaction of our lives, from financial services to identity to the Internet of Things. In this podcast, host Laura Shin, an independent journalist covering all things crypto, talks with industry pioneers about how crypto assets and blockchains will change the way we earn, spend and invest our money. Tune in to find out how Web 3.0, the decentralized web, will revolutionize our world. Disclosure: I'm a nocoiner.