Cold Card Hacked. Do this now

Reader,

Cold Card hacked. Many trusted but didn’t verify. A cardinal rule broken.

Don’t panic.

Stop.

Breathe.

Think, then act.

If you have a Cold Card, funds and your funds have not been affected and you want to move to a new wallet, do this now:

Get a sub-$200 laptop. New, used, doesn’t matter. That laptop stays offline permanently. (If possible, remove Wi-Fi and disable Bluetooth).

• from the online laptop, download a reputable wallet (Electrum/Sparrow) to a USB. Then, install from USB to offline.

Create a new wallet on the offline machine.

Handwrite the 12/24 seed words and script type (e.g., Bech32, SegWit) on paper.

Wipe the wallet instance from the offline machine’s storage drive. Then restore using your handwritten copy. Ensure the device returns to factory state.

• You can return the laptop if you want.
  

Import the restored wallet (fresh instance) into a separate offline tool and verify receiving addresses match those of the original generation step.

Extract the extended public key (xpub/zpub).

• You’ll usually find this in the settings.
  

Perform a full wipe/factory to remove residual memory traces.

Import the XPub into your preferred watch-only wallet application on an internet-connected device.

Compare receiving addresses from the hot and cold wallets. They must match perfectly.

Send a small amount of Bitcoin to a receiving address. Confirm transaction went through an d balance updates are successful.

This setup is for RECEIVING and VERIFICATION only (watch-only). Spending requires an extra step. More later.

Hardware wallets proved fragile this week. Unless you build the hardware yourself, you’re still trusting a 3rd party.

Keep your seedphrase in a box offline. Those are your true keys.

Everything else… is just disposable infrastructure.

To all those affect, my condolences. You will rise again.

Rare

block height 960 465

Note:

On my absence… Became a new dad end of last year. Dedicating time to my little one. Also focusing on building. Thats what bear markets are for.

I’m back now. And in time it seems.

Looks like Bitcoin needs rational voices again.