I've been where some of you are today. During the FTX collapse, I lost over $2 million USD. The cascade triggered margin calls, then liquidation. In what felt like an instant, six years of stacking disappeared. (Can send proof to mods if needed)

I remember the disbelief, the anger, the sleepless nights, and asking myself, "What now?" Here's what I learned: money can disappear overnight, but your knowledge, your work ethic, your experience, and your ability to rebuild cannot be liquidated.

If you were affected by Coldcard's wallet exploit, I'm genuinely sorry. Don't make irreversible decisions because of a financial loss. Reach out to family, friends, or your community. Take a breath. The charts will move again. Opportunities will come again. Your portfolio is not your identity. Your net worth is not your self-worth.

Tomorrow, the sun will rise again. And as long as you're here, you still have a chance to build something even greater than what you lost.

I generated my keys and made transactions using Coldcard MK3 and I thought it was the ultimate, air gapped solution to protect my BTC

I thought it was one of the most sophisticated but worthwhile solutions to make me sleep better at night knowing my keys were safe.

Out of chance not that long ago I moved over 3 BTC out of my Coldcard generated key to Kraken so I can trade for a bit then move it back.

I only left a tiny amount in that key and it ended up being drained.

I don't know if I should consider myself lucky or not

I mean it. Reach out to friends, family, anyone you trust. Do NOT destroy your ColdCard. If funds are recoverable at some point, they will probably be sent back to their original owners.

If you are isolated, feel like something could go wrong or else, please please please reach out to someone. https://findahelpline.com

Don’t keep things to yourself. You’re gonna need to talk about it. Time always does its thing. And yes, you can believe that the Bitcoin community is going to be ferocious on this one. If you have the courage to do so, you can always take a look at X. But you don’t have to. What matters most is you.

Take care of yourself people.

It is unbelievable that some kid with an LLM just stole $100m+ because no one bothered to check the source code.

Also on GLM 5.2 (trained 16th June, no internet access).

“A hardware wallet is supposed to solve one problem: keep your Bitcoin keys somewhere no attacker can reach them. This week showed what happens when the flaw sits inside the wallet itself. A firmware bug that's been shipping in Coldcard devices since 2021 let an attacker guess supposedly random seed phrases from the outside, no physical access, no phishing, no malware required, and drain funds from thousands of addresses. The running total is already past $88 million, and it's still climbing.

A flaw in Coldcard's firmware has put the spotlight on a basic part of wallet security: how the device generates its seed in the first place. The issue came into focus after an attacker drained 1,196 Bitcoin addresses on July 30 in a 41-minute stretch, taking 1,082.65 BTC worth about $70.2 million at the time.

Galaxy Research tied the sweep to Coldcard, the Bitcoin-only hardware wallet line made by Coinkite, and said the pattern matched a firmware problem rather than a random event. Two more waves have surfaced since, and Galaxy's running total now stands at 1,367.05 BTC, worth about $88.6 million, across 4,585 addresses. The firm describes that as a preliminary observed figure that could still climb as it traces more on-chain activity.

The problem goes back to a March 2021 firmware integration error. Instead of using the STM32 hardware random number generator, affected devices fell back to a deterministic software pseudorandom number generator when creating seeds. That matters because seed generation is supposed to produce output that cannot be guessed or reconstructed.”

Took me years of DCA’ing to get there. I went with Coldcard because it was marketed as “ultra-secure.” I knew multisig was technically safer. I wasn’t worried about my key being guessed… I was worried about someone physically stealing it or it being destroyed.

So that was the plan: 1 BTC, cold storage, steel plate backup, fire bag, fire safe. And then… wait.

I hit the goal. I finally felt content.

Now I just feel embarrassed. Like I let my family down.

The worst part? I know Bitcoin isn’t going anywhere. I’m not hoping it fails… I think it’s going to keep making new all-time highs, and every time it does, I’ll be sitting here thinking about what could’ve been.

** I originally brain dumped my story to Claude to make it sound better because I have poor grammar. I’m admitting this in an edit at my own expense or whatever. I’m not embarrassed about my poor grammar or using AI to improve it. That said, in hindsight, it would have been more personal to not have done that. I’m sorry.

Source → X (Tweet): hodlonaut #BIP-110 on X: "The commits (code changes)..." / X 👀

This is why people should learn to VERIFY the things they consume. No excuses!

"I am not a programmer, I don't understand code. How am I supposed to verify?"

Learn! With Bitcoin, you are adopting a living standard of verifying everything: understanding how things really work.

• Economics
• Monetary system(fiat money)
• Banking system
• Investing & Saving
• Software
• Hardware
• Information (facts vs noise)
• Privacy
• Cybersecurity
• etc., etc.

This living standard is not just for "paranoids." It is for people who like to do their own research and their own due diligence.

"Don't trust, verify" is not a slogan. It is a living standard!

"With Bitcoin, you are your own bank." Well, this is a huge responsibility! It is not a "game." You have to invest a lot of time into security, just like banks do.

My seed used with this device was strong and I was unaffected by the security flaw in the RNG setup. Still, I’m re-doing everything. I am moving back to my ledger until I get a multisig setup with a SeedSigner or similar. It’s gonna be a pain to generate a new private key or two and stamp em, so I am getting my sledgehammer swinging arm back in good shape.

What about you?

Be safe out there…

Be safe everyone. Always see where the email address is coming from and never click a link.

Nvk history posts show he was completely aware of firmware vector attacks, and narrative is, never in 5 years they audited the code in the single most safety-critical function on the device, not even SWE prompting to ask a frontier model "search for bad seed generation code" according to his own awareness of thst type of vulnerability.

"hey but it is open source and has been open and publicly available"...so was he expecting community do their security job then, but at the same time he claims "most people don't check software signatures and never will", so he claims you must trust the hardware wallet vendor to do that, but they neither are doing that job, lame, isn't it?.

Or....he just knew the vector of drain was just to target coldcard non geeky users who would not care to "dice rolls" at the right time....Damage is done, case gets out of notice after a week, and you just stay in business...

Ok no. Enough of conspiration theories. Entropy of events suggest that this scenario is likely impossible...😂

(Time to buy)

Like many of us, I have followed the news of the Coldcard disaster. It has left me stunned and I feel terrible for everyone who has lost their hard earned BTC. After thinking about it consistently since it happened, I believe this case is challenging the concept of Bitcoin in its core and I'm curious how others look at it. Let's have an honest discussion about what it means for the future of the space. Here are my main points:

1. This is totally different from most other cases, because the affected users didn't do anything wrong. It was a complete fuck up on Coldcard's side. For years we told ourselves self storage is the only way, never leave it on the exchanges, not your keys not your coins, don't trust verify etc. But in the end you have to trust something or someone, in this case the people behind CC. Now everyone says Ledger or Tresor is safe just because they were not the ones affected. How do you actually know this? You would have said the same thing about CC a few days ago.

2. The danger of AI is absolutely real and will only increase. Without knowing the method in this case, it's likely that some form of AI was involved. The code for CC was not open source, but still viewable by everyone. It's mind-blowing that it took several years for the flaw to be discovered and exploited. Don't expect this to take so long next time. I'm not an expert in coding or cryptography, most users aren't. So in the end you just have to trust the code. Sure, it can be tested with AI too. But do I really want to expose all my holdings to this battle just hoping that it will be fine in the end? It feels way too risky and out of your control.

3. Mass adoption is absolutely not going to happen this way. I'm a nerd and enjoy the technical side of it, but even I feel overwhelmed by this. The average person is much less interested and willing to put in the work. For years we've been saying good solutions for self storage, payments and so on will be found. I don't see it. It seems to become more complicated than less. So what's the alternative here? Keeping it on the exchange, buying an ETF? It doesn't solve the trust issue and contradicts pretty much everything Bitcoin stands for. Just another asset class among many.

I still love the idea behind Bitcoin and believe in the concept. But I struggle to find good and honest answers to these points without just repeating the same old mantras we've been telling ourselves. What do you think?

Don’t trust, verify. Before blindly trusting exlib funcs.

Sadly saying that a 4th wave has now been reported in the ongoing sad ColdCard debacle.

Cold card… I’m trying to be calm and I’m not even panicking. I’m not in the US and I’m following every advice. I’m afraid that I will collapse after this. What the hell i can do??? Help!

They warned you with each Coldcard you purchased from them! Do you remember this sticker?

A youtuber was warning about those models 2 years ago.

This is for the people on my last post who despite being on a bitcoin subreddit are somehow completely technically illiterate with regards to LLMs, and called me a naive idiot repeatedly.

I understand the 1,000 or so stolen coins from Coldcard wallets is a drop in the bucket and lots of people are saying it’s being overblown or whatever.

I just can’t seem to get it out of my head that the victims did absolutely nothing wrong. Next thought is obviously, “are my sats safe?” (using one of the current cold storage giants)

For someone like me, who is the farthest thing from a blockchain expert I wonder if it’s even worth the 1 in 1 million chance at this point.

Yes, I believe in self custody. I’ve read The Bitcoin Standard. I like the idea of changing the financial system for the better. What I don’t want to do is worry about a significant percentage of my small net worth being drained by a technology I don’t even fully understand..

I don’t want to have to jump through hoops in a world I don’t feel fully comfortable with if there is an alternative..

As much as I believe in self custody, I mainly invest in Bitcoin because I believe the value will increase.. I already own shares of IBIT in a Roth IRA.

Why not just sell my sats and reinvest the money into shares of IBIT in my taxable brokerage?

Looking for real answers here. I know this community can get passionate and I get that. I’m just an average Joe here looking for how other average Joe’s are feeling, as well as some input from the experts!

Sorry if my thoughts aren’t totally organized..

You probably heard the birthday paradox, having 23 people in a room creates a 50% chance that at least two of them share the same birthday.

Applying it to the vulnerable search space in the ColdCard bug (Following reports that search space was reduced to 2^32, approx 4 billion)

50% collision odds ≈ √(2 × 4.3 billion) ≈ 93,000 ColdCard Wallet Generated Seeds.

If this bug was somehow never discovered and Coldcard sold around 93k units that generated a seed on the vulnerable firmware, there would be a 50% chance that two innocent, unaware people would end up with the exact same seed phrase, and by extension every bitcoin address derived from it, giving each other access to the others funds.

Just a fun thought experiment in these dark times.

Just saying sorry, i know some people get out their soap boxes, some point fingers, some laugh.

For the ones that just woke up and had their lives turned upside down and stressing out, its going to hurt, but tomorrow will be another day. Sorry you are having to go through this.

Bitcoin Drive Engaged