Critical Coldcard security flaw — move your Bitcoin funds immediately

Full text

Bitcoin Magazine

COLDCARD SECURITY RISK: IMMEDIATE ACTION REQUIRED

First, yes, that is a very clickbait title and completely unusual. This is a real security issue. Here is the official announcement from Coinkite themselves posted yesterday , please read and verify the genuineness of the issue there.

TLDR: Coldcard MK3, MK4, MK5 and Q are being drained. A bug lets attackers find your seed phrase without any action on your part. Only wallets generated using the dice roll method are safe, assuming you rolled at least 50 dice. If you don’t know, don’t remember, or aren’t sure, move your funds immediately.

This is a critical issue that requires immediate action. If you used a Coldcard to generate a word seed and did NOT use the recommended 50+ dice rolls to provide your own entropy after the end of 2020, your word seed is not secure . It was generated without a sufficient amount of randomness, and can be brute forced by a malicious attacker. Wallets are actively being drained now. This issue also affects any ephemeral keys and session keys for Clone Coldcard or Key Teleport features, and BIP 85 seeds generated from a compromised seed . YOU MUST STILL MOVE YOUR FUNDS.

This attack is being actively exploited, with around 1000 BTC seen moving on-chain connected to the vulnerability.

Breath, and relax. You must move your funds to a new word seed, or a word seed generated by a different device, in order to secure your funds.

– If you have another hardware wallet that is not a Coldcard, send your funds there. This is the quickest and simplest way to get them someplace secure.

– If you do not have another hardware wallet, and only have a Coldcard, generate a passphrase using at MINIMUM six seed words from the BIP 39 word list. U se this guide to select your words for the passphrase, do NOT pick them yourself . Check your wallet fingerprint (or an address), power down your device, restart it and re-enter the passphrase. Confirm that the fingerprint (or address) matches, and send your funds to the passphrase wallet. This is not a permanent solution. This is simply giving you enough security that an attacker will not be able to brute force your keys in a matter of days, and you can generate a new seed without being in a state of panic. Make sure your passphrase is written down securely.

– If you have no other options, or are uncomfortable with using the device at all, Nunchuck wallet available on mobile and desktop. Take your time, don’t rush yourself too fast, and make sure that all of your backups are done properly. After you have verified backups, send your funds to this wallet. If you are managing significant sums, Nunchuck has support for multisig. You can create one using multiple devices. Blockstream Green and Bluewallet are two other options for software wallets.

Once your funds are secure, take a minute and relax. Coldcards are still safe to use as long as the word seed is generated securely. A firmware patch has been released here . Any word seed generated after this firmware update should be secure (and you can use the dice roll option too). If you have transferred your funds to a hot wallet, or something less secure, your Coldcard is safe to use after applying the firmware update and generating a new seed.

Once you have secured your own funds, stop and take stock. Reach out proactively to anyone you know who might be using a Coldcard that was vulnerable when they generated their seed. Inform them of the issue, and if needed (and you are capable) help walk them through migrating their funds. Everyone doesn’t pay attention to Bitcoin news on a regular basis, so many people might be unaware that they are even vulnerable.

This post COLDCARD SECURITY RISK: IMMEDIATE ACTION REQUIRED first appeared on Bitcoin Magazine and is written by Shinobi .