Sharing our experimental call summaries.
Al-generated digests of Yak Collective study groups.
Reading:
The Paranoid Wallet: For five years, the most trusted wallet in Bitcoin generated keys an attacker could guess
https://www.citadel21.com/the-paranoid-wallet
Critical Coldcard flaw: what happened, who is affected, and what to do
https://wizardsardine.com/blog/coldcard-rng-vulnerability/
On the night of July 30, 2026, an attacker spent about forty minutes moving other people’s Bitcoin. The coins came out of thousands of addresses, in waves. By August 4, the research firm Galaxy put the confirmed haul at 1,596 bitcoin taken from roughly 7,300 addresses across three waves and fourteen smaller incidents, and estimated that including suspected cases would push the total toward 2,000 bitcoin, on the order of 130 million dollars. Nobody was phished. No malware was involved. No device was touched. The attacker did not need any of that, because the wallets had told the world their secret years earlier, in the way they were born.
This session examined a major security vulnerability in the Coldcard Bitcoin hardware wallet that enabled attackers to steal approximately $70 million in cryptocurrency. The group discussed the technical details of the flaw (a pseudo-random number generator used for seed phrase generation instead of a true hardware random number generator), the social and organizational context at Coldcard, the broader implications for hardware security and cryptography, and long-term questions about whether software bugs are finite or infinite. The conversation ranged from forensic analysis of the vulnerability to philosophical questions about the future of cybersecurity in an AI-enabled world.
Technical Details of the Vulnerability
Nathan Acks: The core issue involves overlapping problems: (1) general reporting focused on one bug, but multiple distinct issues existed; (2) a macro definition didn’t do what developers thought it did; and (3) “dead code” (a disabled random number generator) was actually “undead code” that still got used, creating a security audit red flag. He emphasized that dead code should be removed entirely because it inevitably causes problems.
Anuraj R | U+0300: Coldcard uses MicroPython (a subset of Python ported to microcontrollers). The developers took MicroPython code with hardware random number generator options but configured it to use a software pseudo-random generator behind a flag, believing the flag would disable that code path. Instead, the software RNG was used for seed phrase generation—the most critical cryptographic component.
Ben Mahala (EST): Bad seed phrase entropy is nearly undetectable: any seed phrase looks statistically normal, even if generated with terrible randomness. Seed phrases generated with flawed entropy would pass most statistical tests because that’s what pseudo-random generators are designed to do. The seed phrase is the root of trust; once compromised, a new one must be generated and funds moved before attack, but there’s no patch that affects existing compromised wallets.
Attack Timeline and Nature
Nathan Acks: The vulnerability appears to have been known for 4–5 years internally. An initial ~$70 million theft seems well-researched and deliberate, suggesting attackers knew about the bug long before disclosure. Once disclosed, it became a “free-for-all,” with multiple attack waves and likely multiple attacker groups.
Anuraj R | U+0300: The founder (NVK) dismissively ignored early user reports of coin loss on forums. Once AI tools arrived, attackers systematically swept through addresses to identify high-value targets, then timing attacks during holidays.
Ben Mahala (EST): The attack required coordinated effort (sweeping addresses, identifying targets, executing theft), suggesting a team rather than an individual—unless done by an insider or with advanced AI tools.
Organizational Context
Ben Mahala (EST): Coldcard was a small shop (probably fewer than five technical people) with disproportionate budget spent on marketing. They positioned themselves as “Bitcoin only” and adopted a combative social media stance. This has been characterized as an “affinity scam”—selling overpriced substandard products to a culturally aligned audience.
Anuraj R | U+0300: The small, understaffed team took shortcuts. They may not have thoroughly audited how MicroPython features actually worked.
Audit and Security Limitations
Nathan Acks: Many audits are narrowly scoped and miss cross-module interactions like this. The vulnerability required understanding how a macro definition interacted with code paths across different modules—exactly the kind of thing a narrow audit would miss. He praised whoever caught it in the commissioned audit.
Venkatesh Rao U- 0700: This is a classic “normal accident”—the combination of individually low-probability events (different teams’ code, flag misconfiguration, code path assumptions) converging unpredictably. This is how nuclear and airline disasters happen.
Disclosure and Responsible Disclosure Debate
Nathan Acks: Full disclosure made the situation much worse. Progressive disclosure (notifying vendor, giving time for patch, then going public) is standard practice but didn’t happen. CoinKite’s initial defensive posture suggests they might not have cooperated even with responsible disclosure.
Anuraj R | U+0300: MicroPython (developed by a separate team) is ported to thousands of microcontroller variants; not all have hardware random generators, forcing Coldcard to provide a fallback option.
Broader Security Landscape
Nathan Acks: Bitcoin is “culturally primed” for cold storage; Ethereum’s multisig and client diversity offer better protection. This flaw could affect any blockchain but hit Bitcoin hardest.
Venkatesh Rao U- 0700: The vulnerability could have been detected by advanced AI (e.g., Claude, GPT-4) scanning code. Now that the bug is known, AI tools will scan other hardware wallets for similar patterns.
Venkatesh Rao U- 0700: If frontier AI models can detect these bugs but are restricted via guardrails, there’s an asymmetry: nation-state actors with unrestricted AI access will find bugs that ordinary defenders cannot.
Long-Term Questions: Finite vs. Infinite Bugs
Nathan Acks: Bugs are not zero and won’t go to zero, but cybersecurity will improve over 10–15 years. The Internet will become “radically more hostile” to humans in the near term because humans are the easiest attack surface. Eventually, AI-assisted code auditing may become standard in build pipelines.
Ben Mahala (EST): Entropy is finite; there are always new failure modes. Whether bugs are truly finite in a codebase or infinite depends partly on whether development stops and code ossifies.
Anuraj R | U+0300: This is a “push and pull” system. Security was previously maintained by obscurity (large, unexamined codebase). Now AI can quickly grasp large codebases and find old dead code and tech debt, potentially accelerating bug discovery.
Venkatesh Rao U- 0700: Once code is ossified and no longer updated, bugs might become finite. But the metaevel question remains: if that code runs in emulation on future hardware via emulators, are new vulnerabilities introduced in the emulation stack?
Best Practices and Workarounds
Ben Mahala (EST): Physical, non-software entropy generation (e.g., Solitaire Seed Picker, shuffling cards) removes software bugs from seed generation. However, people can’t be relied upon to do extra work versus pressing a button.
Venkatesh Rao U- 0700: Only trust sufficiently large (but not too large) organizations. In the AI era, security-critical code should undergo formal verification, fuzz testing, and extreme stress testing before production. Assume nation-states are stockpiling attack vectors.
Jenna Dixon U-0500: If you hold significant funds, the extra effort of manual entropy generation is likely worth it.
Venkatesh Rao U- 0700: Do not immediately update firmware after disclosure; a 2021 update to Coldcard may have inadvertently changed secure patterns to insecure ones.
Interesting Asides
Jenna Dixon U-0500: Compared the need to hide valuables in hardware wallets to historical practices (e.g., Pearl Buck novel where Chinese farmers sewed valuables into clothing hems)—a poignant return to physical security.
Ben Mahala (EST): A cryptographic abacus or purely physical entropy device would be hard to compromise in a way that isn’t obvious.
Venkatesh Rao U- 0700: Curious about where else pseudo vs. true random number generation has real consequences.
Whether bugs go to zero or remain infinite: Nathan Acks leans toward “bugs improve significantly over 10–15 years” but didn’t claim they’d go to zero. Ben Mahala and Anuraj R | U+0300 argue entropy makes infinite failure modes possible. Venkatesh Rao and Nathan Acks debate whether this is ultimately offense- or defense-dominant. No consensus reached.
On updating firmware: Venkatesh Rao U- 0700 noted that a 2021 firmware update may have made Coldcard less secure, so updating immediately post-disclosure might be the wrong choice. This wasn’t debated but stands as an important counter-intuitive point.
Responsible disclosure viability: Nathan Acks doubts CoinKite would have cooperated even with a disclosure process given their defensive initial reaction.
Single attacker vs. team: Ben Mahala initially suggested a team, but Venkatesh Rao U- 0700 later suggested advanced AI could enable a single motivated person to audit, plan, and execute the attack.
Coldcard hardware wallet (subject of the vulnerability)
MicroPython (embedded Python, ported to microcontrollers)
Ledger and Tracer (competing hardware wallets mentioned for comparison)
Matthew Green (cryptographer cited by Nathan Acks for concerns about software becoming “too secure”)
Hugging Face incident (mentioned as a contrasting AI-related security event involving rogue agents)
Pearl Buck novel (referenced by Jenna Dixon for historical precedent of hiding valuables)
Solitaire Seed Picker (manual card-based seed phrase generation method)
Normal Accident Theory (referenced by Venkatesh Rao U- 0700 for how multiple low-probability events combine)
Quantum proofing / stockpiling attack vectors (analogy by Venkatesh Rao U- 0700 for nation-state AI surveillance concerns)
Nathan Acks: “The only dead code is code that’s gone from the code base. Otherwise, it’s undead code, and it’s going to bite you and eat your brains.”
Ben Mahala (EST): “Bad entropy is so harsh because it’s almost undetectable when you’re doing it. You know? Any seed phrase will look almost anything like any other.”
Venkatesh Rao U- 0700: “This is a classic example of what’s called a normal accident, which is a couple of different events that are themselves of extremely low probability somehow combined in ways that you really cannot predict.”
Call chat on Yak Collective Discord:
https://discord.com/channels/692111190851059762/1538911775007703161
No posts
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.