Episode 101: The COLDCARD Hack

Aaron and Sjors discuss the COLDCARD hack: the bug itself, how it could have happened, and some reflections on having had Coinkite as a sponsor.

Note: If you’re using a COLDCARD and still haven’t moved your funds to a secure location, do this as soon as possible. (Also listen to the previous emergency broadcast.)

Further reading:

https://wizardsardine.com/blog/coldcard-rng-vulnerability/

https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware

Chapters

00:00:00 The Hack and Weak Seeds

00:05:33 Simulator Code and Weak Randomness

00:19:15 Why MK4 Was Vulnerable

00:25:56 Open Source and Security Audits

00:35:34 Preventing the Next Failure

00:38:47 Multisig and Custody Tradeoffs

00:44:11 Could Victims Recover Funds?

00:48:50 Our Sponsorship Responsibilities

Aaron’s Nostr: npub1art8cs66ffvnqns5zs5qa9fwlctmusj5lj38j94lv0ulw0j54wjqhpm0w5⁠

Sjors’ Nostr: npub1v25jqj332n630klwtqeqxgyrjl4alw4phmluhu2x6lcxzwy9m03suqexw3

If you’d like to sponsor the show, please email info at bitcoinexplainedpodcast.com.

https://bitcoinexplainedpodcast.com/