Coldcard Vulnerability: Is Your Bitcoin Safe? ($89 Million Gone) | The Canadian Bitcoiners Podcast
The Canadian Bitcoiners Podcast - Bitcoin News With a Canadian SpinShow Notes
Coldcard vulnerability explained: $89 million in Bitcoin gone in four days — the thief never touched a device.Full show notes & past episodes → https://canadianbitcoiners.comCoinkite is a Toronto company. The Coldcard is the Bitcoin hardware wallet serious self-custody people trust. On July 30th an attacker swept 1,082 BTC out of 1,196 addresses in 41 minutes, then kept going. Block's engineers found the cause: one mis-written line in Coinkite's own library meant Coldcards had been generating seeds from a predictable number generator instead of the hardware chip. Since March 2021. Nineteen hundred and sixty-one days.Nobody was hacked. No device opened, no server breached, no malware installed. The keys were calculated offline from public data, and the blockchain checked which guesses had money on them. If you rolled 50 or more fair, private dice rolls setting your Coldcard up, Coinkite says that seed isn't at risk from this bug. If you didn't, move your coins.In this episode of the Canadian Bitcoiners Podcast:— How one keyword collapsed seed entropy from 128 bits to roughly 40 on Mk2/Mk3 (about 72 on Mk4, Mk5 and Q)— Why "Coldcard was hacked" is the wrong headline, and why the distinction matters— NVK: "I'm sorry and I'm devastated" — and the AI excuse nobody's buying— The 2021 commit that shipped seed-generation code with no pull request— Coinkite emailing customers back to 2019, and the privacy problem that raises— SparkKitty malware reading photo galleries for seed phrase screenshots— Apple sued for $1.8M over a fake Sparrow Wallet that passed App Store review— Celsius' old mining rigs became an AI data centre, listed at $2.8B— Bitcoin Independence Day: what August 1st still means nine years on— Ford and Piccini's $11,700 Disney trip, Grewal's ads in his father's paper— The Supreme Court tells Parliament it can't put a watchdog beyond the courts— Groceries top what's draining Canadian bank accounts: 76% say so— 50,000 applications for 700 CNE jobs, realtor counts falling, Peel shootings up— Chow vs. Ford on the waterfront, Billy Bishop, and the Alto deal falling apart— Ottawa bought 3,196 motorbikes for Ghanaian farm agents and never budgeted the gas— New York's municipal grocery stores at 30% offSelf-custody didn't fail this week. A software supply chain did. Dice, passphrases, verification and multisig exist for exactly this — and the people who used them still have their Bitcoin.— Canadian Bitcoiners Podcasthttps://canadianbitcoiners.com — subscribe and turn on notifications for the Monday show.#Bitcoin #Coldcard #CanadianBitcoiners #Coinkite #SelfCustody #MSTR #BitcoinNews #BitcoinCanada————————————————————————————————SPONSORS🔒 easyDNS — Canadian-owned, ICANN-accredited registrar that has accepted Bitcoin since 2013. Domains, DNS, email, hosting, all without selling you out. Use promo code **CBP Media** for 50% off your first purchase, no limits.→ https://easydns.com⚡ Bull Bitcoin — Canada's non-custodial, Bitcoin-only exchange. Founded 2013 in Montreal. They never hold your keys; you self-custody from day one. CBP listeners get 25% off fees for life.→ https://app.bullbitcoin.com/registration/cbp🔥 256 Heat — Hashrate heaters: Bitcoin miners purpose-built to heat a space. Every watt of electricity becomes heat AND hashrate, so you're warming your space and stacking sats at the same time. Custom solutions available. Tell them CBP sent you for a discount.→ https://256heat.com🎓 Bitcoin Mentor — One-on-one coaching to take you from "I bought some Bitcoin" to true self-sovereign ownership. Wallets, keys, collaborative custody, inheritance planning, node setup, the whole stack. 30-day money-back guarantee on every package.→ https://btcmentor.io/aff/joey————————————————————————————————FOLLOW THE SHOW🎙️ CBP — https://x.com/CanadianBTCPod👤 Joey — https://x.com/joeytweeets👤 Len — https://x.com/thebtcpricebot————————————————————————————————
More from The Canadian Bitcoiners Podcast - Bitcoin News With a Canadian Spin
MSCI adopted its non-operating company rule on October 15, and the companion spreadsheet of potentially impacted securities lists Strategy with a potential action of "Deleted" — roughly $40.3B of the $44.4B of float-adjusted market cap on that entire list. The affected names publish November 11 and the change takes effect at the close on November 30, leaving 19 days between the list and any forced selling. MSTR dropped 9.56% in a single session after the decision. Tonight, Joey and Len walk through the 4-of-5 ratio test, whether Strategy actually trips it, and what index removal does and does not do to the Bitcoin sitting behind the stock. MSCI's announcement names no company, and Strategy says MSCI-linked funds hold only 3.1% of its basic shares.
MSCI adopted its non-operating company rule on October 15, and the companion spreadsheet of potentially impacted securities lists Strategy with a potential action of "Deleted" — roughly $40.3B of the $44.4B of float-adjusted market cap on that entire list. The affected names publish November 11 and the change takes effect at the close on November 30, leaving 19 days between the list and any forced selling. MSTR dropped 9.56% in a single session after the decision. Tonight, Joey and Len walk through the 4-of-5 ratio test, whether Strategy actually trips it, and what index removal does and does not do to the Bitcoin sitting behind the stock. MSCI's announcement names no company, and Strategy says MSCI-linked funds hold only 3.1% of its basic shares.
Ledger has confirmed an unauthorized hardware implant in an affected device sold through CryptoBilis, a reseller listed by Ledger. How can a hardware wallet pass a Genuine Check while a physical implant spies on its setup? Tonight, Joey and Len examine the reported supply-chain attack, the limits of device verification, and what this does to trust in self-custody. Loss totals remain third-party estimates; the confirmed implant does not establish that every Ledger device is compromised.
Ledger has confirmed an unauthorized hardware implant in an affected device sold through CryptoBilis, a reseller listed by Ledger. How can a hardware wallet pass a Genuine Check while a physical implant spies on its setup? Tonight, Joey and Len examine the reported supply-chain attack, the limits of device verification, and what this does to trust in self-custody. Loss totals remain third-party estimates; the confirmed implant does not establish that every Ledger device is compromised.
Ari Paul alleges Coinbase lost $25 million of BlockTower's money and concealed more than $1 billion in hack losses. Coinbase denies hiding a series of hacks or losing $1 billion, and Paul's claims remain unverified. Tonight, Joey and Len break down the allegations, Coinbase's response, and the risks of trusting someone else with your Bitcoin.