Avid

All models are wrong, some are useful.

[Avid @AvidXBT]

@bradmillscan @Bitkey Bro you don’t need help, just follow the instructions, super user friendly.

[Avid @AvidXBT]

@Lambchoppa1 Warm it up and sometimes it will take a charge, try a rice sock or heat pad

[Avid @AvidXBT]

@2140btc @The_BTC_Patriot There is a huge oled screen dude.

[Avid @AvidXBT]

@digitalix Darmok and jilad at tanagra

[Avid @AvidXBT]

Insane how bad the entropy was

[Bitcoin Policy Institute @bitcoinpolicy]

We made a short visual explainer to help people understand the Coldcard bug, and what it means for the security of affected wallets.

Bitcoin's entire security model depends on a user's ability to select astronomically large numbers from a truly random set.

If you imagine every possible Bitcoin private key as individual atoms, when a private key is generated properly, the pool of possibilities is so large that it's like an attacker is hunting for one specific atom hidden somewhere across 2 billion galaxies. No classical computer could ever search that many possibilities.

Unfortunately, affected Coldcard firmware drew its seeds from a much smaller, more predictable pool. If every possible Coldcard private key was an atom, the possible set of keys would only be about the size of a large virus. In comparison, a standard computer could work through that space in just a few hours.

Our video helps visualize what this difference looks like, we hope this is helpful for everyone to establish the importance of true entropy in key generation.

We are deeply sorry for anyone who lost funds to this bug. We know several people that were personally affected, including members of the BPI team. Losing funds after working hard protect your wealth is extremely difficult.

We are developing a set of policy reflections based on this vulnerability that we hope to publish as soon as possible.

[Avid @AvidXBT]

@sunny051488 They offer TOTP, better than SMS

[Avid @AvidXBT]

Yikes

[COLDCARD @COLDCARDwallet]

@blk014 It’s when the project makers could have a “bug” in the entropy generation for later retrieval.

[Avid @AvidXBT]

@CallanCBKey @the_smart_ape @Trezor Airgap is a larp, coldcard proved that.

[Avid @AvidXBT]

@albertahodl What pisses me off the most is the influence campaign that pushed so many to abandon ledger/Trezor only to get wiped out by tickle-me-Elmo grade entropy from the coldcard.

[Avid @AvidXBT]

@cguida6 We know this because there were user reported drainings going back to at least 2022, one guy got blocked by NVK for trying to report it.

[Avid @AvidXBT]

@sunny051488 @mothoshi I don’t think so, but you can see it came from a multisig address, I’m guessing it’s multisig, 100BTC is no joke

[Avid @AvidXBT]

@sunny051488 @PeterSchiff Bitcoin was not hacked, some peoples bitcoin was left un-secured.

[Avid @AvidXBT]

Almost everything about the CC RNG fiasco borders on unbelievable.

[Matteo Pellegrini | Club Orange @matteopelleg]

i spent the whole weekend studying the Coldcard hack

IMO the biggest lesson is not that an RNG failed

it’s that the wallet silently downgraded to weaker randomness AND still told the user everything was fine

[Avid @AvidXBT]

@BitPaine It's like they don't realize how ridiculous it all is.

[Avid @AvidXBT]

@BTC_broo Warm it up and you can revive it. Not too hot but like a hot back or hot pad.

[Avid @AvidXBT]

@BigCheds @Tradermayne Seriously, it gives off low-T energy.

[Avid @AvidXBT]

@BitcoinTeacher_ Multi-vendor multi-sig with threshold and geographic distribution.

For a single device the Bitkey uses a 2/3 multi-sig, great for normies

[Avid @AvidXBT]

I had seen some rumors about this a while back.

[The ₿itcoin Therapist @TheBTCTherapist]

Holy shit. 4 years ago someone reported their Coldcard wallet got drained after using the RNG feature with no dice rolls and he was subsequently blocked by Coldcard.

They had 4+ years to address this issue.

This horror story just keeps getting worse.

H/t: @Zenul_Abidin