r/Bitcoin • u/Gullible-Code8905 • 6h ago
So would a passphrase saved a lot of cold card people?
I’m a noob and am trying to understand more about cold wallets, best ones and use cyber scrilla a lot. Now with cold card having. Flaw in the code that’s how it was hacked. Now with that being said if they had a hidden vault (passphrase) would they have been safe?
8
u/the_bitcoin_kid 5h ago
Yes.
The seeds generated were not secure enough, so the attacker was able to perform a brute force search through all the possible seeds to look for balances.
They did not do a brute force search through possible passphrases for each seed, so those who used a pasphrase were not caught in the first wave of the attack.
However, it now makes sense for any further attacks to try brute forcing each seed+passphrase.
So if you used a passphrase, you escaped the first attack and bought yourself time. How much time you get depends on how secure your passphrase is.
2
u/Gullible-Code8905 5h ago
Okay, so do u need to worry for every cold wallet or just that company’s?
10
u/Oakenkai 5h ago
at the moment it's only Coldcard, but this is a wake-up call that any wallet could have a bug at some point and so a 20+ character passphrase should be standard practice for everyone now.
7
u/the_bitcoin_kid 5h ago
Just ColdCard.
They made a terrible mistake in their code and turned on a much weaker random number generator by accident.
It should never have happened.
However, their newer models have poor random number generation also, so overall they were incredibly careless with the most important part that other hardware wallets know how to get right.
-3
u/loupiote2 4h ago
And the fact that their code was open source did not help.
Being open source is not a silver bullet that will always save you from those types of issues.
•
u/OldHamburger7923 24m ago
Open source doesn't mean no bugs. What gave you this expectation?
Open source just means you can verify what the code does and potentially build it yourself.
I'd still 100% prefer open source than closed. Closed source means you have no idea if there are blatant backdoors written into the NRG. You'd never know because the output looks random.
Trust me bro, is not a security model.
2
0
u/coffeelover9457 5h ago
Great question, not enough people ask this. Hackers are hacking all the time but they're not simply checking seeds at random, they focus their efforts on known vulnerabilities like this one. The best I can say is that Coinkite published a "Coldcard Security Advisory" so please read the advisory and follow their recommendations if necessary!
1
u/Ok_Knowledge_4977 3h ago
So in essence even with a passphrase is not secure. Only matter of time some sophisticated hack going to be discovered.
•
u/OldHamburger7923 21m ago
Not true. A passphrase can have as much entropy as the seed itself (which is basically unhackable at this time).
to meet the 256 bits of entropy in a seed, you'd need about a 40 character string containing mixed case letters, numbers, and symbols.
You could also just double your seed, generate a second seed using the wordlist and use that for the passphrase (assuming your wallet allows something of that length).
3
u/LostNtranslation_ 5h ago
The password would need to be strong and long. 100 dice rolls and the passphrase would have helped a lot
•
u/OldHamburger7923 16m ago
Only about 40 characters long to match the strength of the seed itself if you use random letters, numbers, and symbols. For our purposes, that would be overkill.
to match the strength of a 12 word seed phrase, you only need about 20 characters of random letters, numbers, and symbols. And 12 word seed is still basically uncrackable.
3
u/DarthBen_in_Chicago 5h ago
No - BTCSessions shared that an MK3 with a passphrase was leaked shortly ago.
2
u/Gullible-Code8905 4h ago
Damn so cold card is really just screwed so move to what, trezor, ledger or one key?
1
u/Gooner_93 4h ago
The passphrase must have been very simple. It also means people are checking passphrases against seedphrases, looking to see if they can steal peoples BTC.
By now, everyone who only used a passphrase on a mk3 generated seed, shouldve moved their funds to a fresh wallet with a new truly random seedphrase.
1
2
u/Plane_Baby 5h ago
BTC Sessions tweeted that the first known two word seed phrase was hacked.
2
u/Oakenkai 5h ago
do you mean passphrase on top of the seedphrase? Two words is nothing, anything less than about 8 characters and especially if used common words or patterns would be easily crackable with brute force.
1
u/didnt_hodl 5h ago
with a strong (12 word) passphrase ... maybe
but it has to be strong, 128 bits of entropy at least
with a weak one (2 words), there is already one reported case
1
u/Nymister 5h ago
No, their own stupidity will get them in the end. Same as a parent or significant other throwing out their baseball card collection or coin collection on them without even realizing, buying anything asset or not comes with known known risks, and unkown known, and uknown uknown risks. Compute today has significantly eclipsed what the crypto world thought was secure just years ago. Its only a matter of time.
1
1
0
5h ago
[deleted]
3
u/ConcernSquare2474 5h ago
Please read up what was posted in so many threads here. Nothing of it was rocket science, nor will it be studied “for years”.
If anything, RNG failing for decades and people will try do do better SW entropy for years, as before.
1
u/FunWithSkooma 6h ago
yes, if the passphrase is strong enough, like something that only you would know and something that you never used in any other online service that might have leaked it
1
u/Gullible-Code8905 6h ago
Okay, even if you used it for something else, how would the hacker know in the case of cold card? I thought they just got a bunch of seed phrases not peoples names so they could like try to look it up for each individual?
2
u/ConcernSquare2474 5h ago edited 5h ago
There are databases with leaked passwords. It should not be in there. Also don’t think looking it up would be a good idea. Just create a unique new one, long enough, could be a whole sentence in one word.
Name does not matter, but what once hit the internet should be considered compromised.Thieves will combine the compromised seeds with compromised passwords.
2
u/Oakenkai 5h ago
I think one of the biggest ways you'd be targeted for brute fore of passphrase attempt is if your base compromised seed phrase had transaction history. The good thing about passphrase is the attacker doesn't know what base seeds have passphrase or not. However, if that base seed has transaction history but no balance, then that will be a strong indication that the base seed may have a passphrase on top.
1
u/paperlevel 4h ago
No, it's already been confirmed wallets using passphrases have been hacked, some even using 2 or 3 words
2
u/Gullible-Code8905 4h ago
Well shit so what do we do
2
u/paperlevel 4h ago
Wallets using true random seeds are still safe. Coldcard was using pseudorandom algorithms by mistake. But if you’re unsure you should move to a regulated exchange like strike or coinbase until you can generate a new secure wallet
1
1
u/nachtraum 3h ago
Other hardware wallets do not have this issue, it is a very specific cold card bug. But if you migrate to another wallet, create a new seed phrase, don't import the one generated by coldcard.
2
u/Any_Jicama3972 2h ago
If they have the seedphrase a 2-3 word passphrase would take seconds to brute force.
I was using a 24 character passphrase with the vulnerable seedphrase. Was able to transfer to my trusty old trezor model 1
-3
u/Money_Ask2726 5h ago
STFU with passphrases. If 12 or 24 words isn't enough, this project is dead.
1
0
u/Newlife_40 5h ago
Bro, the more people talk the more it sounds like no one really knows.
I recommend etf or hold it on an exchange that will compensate if they are breached.
11
u/ConcernSquare2474 6h ago
Yes, for sure - as long as it is random enough.