Coldcard users please be warned about this serious security vulnerability - quick video explainer with a practical mitigation step

Absolutely wild that you are recommending users to continue to use the Coldcard. It needs to be strongly called out that the development process that resulted in this bug means that the products are not fit for purpose and there is inadequate testing.

bip39 word list: Coldcard post Block security post

Firmware update has been released to correct the limited entropy bug

practical mitigation - go to a phone wallet for now, then buy a hardware wallet in a tech store

256 bits of entropy (plus 8 bits for checksum) through coin flipping or roll dicing of randomly-24-generated -seed words with multi-sig signing capability with added passphrase on top. That's the way to go. Never trusted vendors since day 1.

Coldcard s the hard case for holding Bitcoin podcasters and influencers accountable for years of promoting products and services they never verified. When those products fail, the listeners carry the entire loss. The promoters keep the fee and move on to the next sponsor.

@noufsmith Practical assistance to solve immediate risks from @PeterBTCAdviser

Well done Stephan.

@adam3us

Welcome in BIG BITCOIN reality clowm

How do we know their dice roll input is legit?

James has verified from a code perspective

Thank you.

Do you remember your YT vid on hardware wallets, you recommending the ColdCard, and in the comments I gave my evidence that the Bitkey was better, especially for noobs. Do you remember that you deleted my comment, as you were shilling the ColdCard? I remember.

If 2 out 3 of your multisig is affected coldcards then it's not safe. And even if 1 is Coldcard your privacy is gone.

Thank you sir 🙏👍

💙💙

Lmao. My man, the advice should be sledgehammer the fuckin device and transfer it asap to anything but another fresh CC. Even a CEX would be way safer option for temp storage.

TLDR

This is why I never liked vendor entropy as a trust assumption. dice + passphrase or nothing

Is @Trezor safe. A 12 word generated on a model T and using what I now in retrospect consider a shitty passphrase

Delete your account please, do us all a favor.

Recommending ANYBODY continue using cold card, even with a passphrase, as a "mitigation" step DOES NOT GO FAR ENOUGH. It is MUCH easier for people to either a) send to an exchange such as RIVER or b) a trusted hot wallet such as bull bitcoin Both of the above would be short term solutions until a new set up can be created. Continuation of using a cold card is NOT the WAY. Most users struggle with passphrase.

Have you even said sorry for pushing , advertising cold card to your listeners yet? You even had that cunt @nvk on the pod a few episodes ago

How are coins at risk if Coldcard not connected

It has to do with the seed being generated in an insecure way, i.e. a remote attacker can pwn and take the coins if you didn't use enough entropy

passphrase can any word, symbols, you do not need to select them from a list.

Yes I'm aware, I'm just saying 7 words off the bip39 word list is a good "safe" benchmark nowadays