(From The Sovereign Capitalist Letter #65. I was traveling at the time of the Coinkite vulnerability, surfacing a recurring theme around how to safely balance cold storage and emergency access when on the road).
Just when I thought the sentiment couldn’t get any worse, on July 29-30 reports began to emerge of “certain” Coldcards (which were supposed to be the industry standard of self-custody cold wallets), being drained of their funds.
The reports are true, and this has enormous implications, not just for Coinkite, the Canadian company who manufactures the Coldcard, but for the entire worldview of self-custody and perhaps even for Bitcoin itself.
“Not your keys = not your coins” has been the mantra of Bitcoin since the Genesis Block. Self-custody was The Way. Anything else was for “shitcoiners”, “suitcoiners” and general retards.
It is impossible to overstate how strongly the Bitcoin in-club feels about this. If you don’t self-custody – and until this happened, on a Coldcard by Coinkite – then you were not really a “true” Bitcoiner, you were just LARPing as one. A spectator in the land of the pureblood anarcho-capitalist cyberpunks.
(Admission: my BTC wasn’t on a Coldcard – but I had recently bought new one that I was planning to migrate to after the BIP-110 and eCash forks).
When Utopia arrives… only the self-custody maxis would be admitted – all else would be chattel and serfs under various permutations of slavecoins, CBDCs and (the worst of all) paper Bitcoin.
It all sounds very eschatological and in the earlier days of my journey, I would openly admit “Bitcoin is my religion” and only be half-kidding about it.
While this bear market has been a “mild winter” in terms of price action (only about ~ 50% off the all-time high), this has been one of the more self-destructive bear cycles in terms of Bitcoin culture and the movement in general.
None of it helped by the fact that the Coldcard flaw turned out to be real.
People who had done everything right, took their BTC off of the exchange, put it into an air-gapped Coldcard powered by a 9V-battery and thought they were safe, found their life-savings irrevocably drained away in an instant…
Over the years I’ve recommended Coldcard to my readers a few times. We were traveling when the news broke but as soon as I corroborated the vulnerability, I put out an emergency bulletin to the mailing list.
At first it appeared as though the flaw was limited to older Mk2 and Mk3 models, but over the next couple of days Mk4 and Q1 series were also being drained – it just takes more computing power, and thus time, to crack the entropy on the later models.
What Happened – The Coldcard Firmware Flaw
As everyone here knows, a Bitcoin wallet address is a very long cryptographic private key that can be transmitted or stored in a human readable form via a 12- or 24-word seed phrase, consisting of words pulled from a word list (BIP-39) of possible values.
The words themselves are actually unimportant – they’re just there for humans to be able to read the values. The discrete value they comprise is what matters.
And because a given wallet address is secured by a private key derived from a seed-phrase, those words must be in order.
That makes the universe of possible values enormous:
-
12 words gives 2¹²⁸ possible valid phrases
-
24 words gives 2²⁵⁶ possible valid phrases
A 12-word seed space is a vastly larger number than every grain of sand on Earth or every star we can see in the observable universe.
A 24-word seed space is larger than the number of atoms in the entire galaxy, and approaches (but is generally a bit smaller than) the estimated number of atoms in the observable universe.
But that’s only if those words are generated from a truly random seed (entropy source).
Take an extreme example: simply picking the first 12 or 24 words from the BIP-39 word list isn’t random, and a wallet protected by such a seed phrase would be cracked in short order by a brute force computer.
The Coldcard ships with an onboard RNG (Random Number Generator) to generate your seed phrase, however their own documentation states that to achieve maximum entropy (randomness), you should also add some “external entropy” such as dice rolls – real, actual physical dice, rolled, 50 or 100 times – combined with the onboard RNG for maximal security.
Many people did not roll the dice, assuming that the onboard RNG would provide more than enough entropy for a secure seed phrase (remember those numbers above).
The problem was in Coldcard’s firmware itself, where the RNG generator turned out to be bypassed – resulting in extremely weak entropy – and thus, weak seed phrases.
This bug has been sitting there since November 2021 (the Coldcard firmware is open source/viewable),
The follow-up tweet lays out what went wrong in the Mk4 and Q series:
“Mk4, Q, and Mk5 attempt to compensate at boot with secure-element input, but the reseed truncates it to 32 bits, sharply limiting the secret entropy it contributes – far below what wallets should have.”
It later came out that it looks like a developer simply disabled the RNG to workaround some compiler errors:
A new technical analysis by Core-Lightning dev ddustin suggests the 2021 COLDCARD vulnerability may have started while a developer was trying to connect three layers of the firmware: the wallet’s Python code, MicroPython’s C code, and the STM32 hardware random number generator.
The custom code appears to have conflicted with MicroPython’s existing implementation, likely triggering a compiler error.
The evidence suggests the developer then disabled the hardware RNG by setting MICROPY_HW_ENABLE_RNG to 0, allowing the firmware to compile.
That change had an unintended consequence. When users created new wallets, the firmware no longer used the hardware random number generator. Instead, it fell back to MicroPython’s much weaker Yasmarang software random number generator.
There are people out there implying that any wallets drained are somehow on the Coldcard owners, because they didn’t add enough external entropy (read: they didn’t do enough dice rolls, or any dice rolls).
This is a fucking retarded take. It actually makes my blood boil.
No other Bitcoin hardware wallet requires the user to provide external entropy as a condition of the fucking thing working.
People buy these wallets because they purport to be an ultra-secure, self-contained Swiss-Bank-in-your-pocket solution for escaping the fiat treadmill and putting your life savings beyond the reach of The State. Full stop.
There is no asterisk beside those claims that “you have to jiggle your body and roll a bunch of dice dozens of times while waving a dead chicken over your head to add entropy or it won’t work”.
Except, on a Coldcard
Actions to take: If you have a Coldcard, regardless of how you set it up – I would move all of my funds out of it.
What Does this mean for Self-Custody and for Bitcoin?
Indeed. That is the question.
I have been thinking long and hard about this, not to mention conducting a deep dive into the entropy generation on other wallets.
The gist is this:
Every other wallet I came across uses well-known methods for generating entropy that come off of the device itself (such as the the o/s level Cryptographically Secure Pseudorandom Number Generator – CSPRNG) and many of them combine that with several other sources of entropy – any given computing environment offers a few of those (clock speed jitter, etc), and in some cases, dedicated chips just for entropy generation.
But this still had me rattled: why bother worrying about a quantum attack on SHA-256 in 5 or 50 years, when you can just crack the entropy using Fable or Opus 5.6-sol today?
Fortunately, it turns out that is not the case. The Coldcard vulnerability was entirely exploitable, and discoverable, because of a series of bad decisions and programming bugs. It was not a case that entropy had been cracked, it was that insufficient entropy was generated in the first place.
This X post from another wallet provider lays out the reasons why, years ago, Coinkite switched their open-source licensing scheme as well as their own code in the Coldcard firmware – and how by doing so they set the stage for the disaster unfolding in front of our eyes today.
It’s long, but worth including here:
“Regarding the Coldcard entropy bug – many folks are explaining what happened but I wanted to take a minute to explain why it may have happened.
It’s a disastrous situation and our heart goes out to all the Bitcoiners affected.
Here’s a timeline of events:
On July 28 2020: @FoundationHQ announced our first Passport hardware wallet and noted that we were building on Coldcard firmware which at the time was GPLv3 licensed (FOSS license).
On July 30 2020: NVK publicly said he regretted choosing GPL because Coldcard now had a “clone” and that they would change things in future updates.
On November 18 2020: Coldcard added its MIT + Commons Clause license, prohibiting commercial products substantially derived from the software. https://github.com/Coldcard/firmware/commit/b6b9191145d37fbb6d754597350653141596dd12
On January 8, 2021: Coldcard firmware 3.2.1 formally announced, “License changed from GPL to MIT+CC on files for which the GPL doesn’t apply.” CC is the “Commons Clause” license addendum which is “source available” instead of FOSS.
On March 1, 2021: The “First pass w/ libNgU” commit removed the GPL @Trezor -derived crypto libraries and replaced them with libNgU. That same 120-file commit changed seed generation code. libNgU was licensed with a novel “Licensed for Bitcoin Only” license.
On March 17, 2021: Version 4.0.0 announced that all crypto and BIP39 code had been replaced and that the “last remaining GPL code” was removed. https://blog.coinkite.com/version-4.0.0-released/
Our best understanding right now is that the entropy bug was collateral damage from this major overhaul of the codebase.
To be clear, this overhaul was not solely about licensing. Coldcard also cited technical goals including adopting Bitcoin Core’s libsecp256k1, faster AES and SHA implementations, and reproducible builds.
But the timeline establishes two things:
(1) Foundation’s launch was the obvious impetus for Coldcard’s licensing change, and
(2) removing the remaining GPL code was an explicit goal of the subsequent v4 rewrite.
We don’t know by how much the licensing pressure affected the scope or timeline of the rewrite. All we can determine is that the entropy bug was introduced inside the same 120-file commit that removed the old GPL code dependencies.”
Also noting that @nvk (Coinkite’s CEO) deleted the tweets referenced above and has been dutifully scrubbing his timeline since all this broke out. Absolutely abysmal leadership.
All this to say – (because it bears repeating): the issue is not that AI could crack the entropy used to generate seed phrases. That would be game-over for Bitcoin.
What happened instead was that AI was used (at least once it became known that there was an exploit to be found) to uncover a flaw in entropy generation.
Very different.
That means the industry-standard wallets (Trezor, Bitkey, and software ones like Sparrow or Electrum) are fine – and I still feel OK typing that – in fact more so, after the rabbit hole I’ve been down these last 48 hours.
But there are some practical takeaways now, and some possibly unpleasant ramifications, at least for me, and I’ll lay them out frankly here, in no particular order:
-
Multi-sig self-custody is now the bare minimum.
Wallets that require multiple signatures to spend – if you are handling it all yourself, you can still do solo multi-sig, where you require two-of-three signatures to originate an outbound transaction.What I will probably end up doing is prepping some docs or tutorials on getting that set up.
-
Institutional custody is a serious option, which should be considered.
But it comes with trade-offs, one of which is that it’s very difficult to create a multi-generational custodial entity in a nascent space. You almost by definition need to fuse some venerable old tradfi institutions with cypherpunks.The reality is the institutions best equipped or positioned to do this, are not “Bitcoin-only”, which seems to matter to the hardcore maxis.
But there’s another problem with that:
-
Most Bitcoin-only businesses are on their way to bankruptcy.
If not this bear cycle, then the next one.This is because in the overall scheme of things, not enough people actually give a shit about Bitcoin to make a “Bitcoin-only” business viable over the long haul. This includes as many as 90% of the people (total guesstimate) who are actually allocated to Bitcoin.
Most of them couldn’t care less about self-custody, retiring their bloodline, “everything divided by 21 million”, escaping the state, or any of the long string of maximalist purity tests.
They want a double-digit CAGR, and to catch the next bull market updraft. That’s it. That’s the majority of people invested into Bitcoin. Reality check.
-
ETFs are fine.
This needs to be said. Again, there are trade-offs (surprise!):
You’ll miss out on the proceeds of any forks (the ETF sponsor will pocket those) and you’re very much inside the financial system. But they are a way to capture the upside of Bitcoin, hold for the long term, with total liquidity.
-
The right exchanges are also fine.
Another blasphemy but it’s true. One thing I’ve been saying for years is that most people don’t want the hassles associated with self-custody. It’s a high bar and what most people really want is “PayPal for crypto”. And notice I didn’t say “Bitcoin”, I said “crypto” – another no-no word for “True Bitcoiners”, but the reality is that the mass adoption underway is of crypto.
Bitcoin just happens to be a subset of that.
I can envision setups where of the total allocation in a portfolio to Bitcoin, the majority is held via ETFs, while self-custody BTC is akin to our “Bug-out bag” component, along with a lightning wallet loaded up with some “walking around money”.
-
Bitcoin is not the apex asset.
I have been wrong about this. It’s still a category-of-one in the digital asset space, it’s still digital sound money and a store of value, but it’s just another asset class across the possible choices one can allocate into.
The maxi proposition that allocating to anything other than Bitcoin in one’s investments or savings is “retarded” is itself retarded. I remember seeing a tweet some time ago that just broke my heart, where some pleb took his daughter to Burger King for her fifth or sixth birthday and was thrilled that she understood why instead of buying her a birthday present he bought some Bitcoin.
Horrible parenting. Buy your five-year-old a birthday present. Pay them for chores in Bitcoin. Don’t take them to Burger King, ever. Grow the fuck up. You’re supposed to be the adult here.
The apex asset is business ownership. We can talk more about this, and we will.
-
Being 100% invested in Bitcoin or having all your life savings in Bitcoin is a mistake.
Another mistake of mine, in the sense where I proudly declared that easyDNS holds 100% of its retained earnings in BTC. Others hold the sum total of their life savings in Bitcoin.
This is a big mistake – which anybody who just had their life savings drained in under 20 seconds in this episode understands all too viscerally.
Speaking for myself, I will be adjusting my allocation. Probably gradually, because I do think we’re “at bottom” in this cycle, so as we climb out of this bear market, I will be diversifying – likely more aggressively into cashflow-producing businesses.
I’ll do this through a combination of collateralization in a (hopefully) up-trending market, and sales under the right circumstances.
There are a couple of special situations I’m working on where it feels like the most sensible move is to create an investment partnership – so I will be cashing out some chips to seed that fund.
I’m glad I still have gold and numerous investments outside of the Bitcoin and even crypto space. I’m also looking at more real estate. The market is in the toilet now so it’s a good time to buy – and this actually brings us to an important point:
The Bitcoin maxi axiom that it’s always a good time to buy, never a good time to sell, and that Bitcoin is the only investable asset, forsaking all others, has to be abandoned by anybody who is serious about building wealth.
I don’t care about passing the Bitcoin purity tests. Maybe I did in the past, which was also a mistake.
Remember when Luke Gromen sold Bitcoin right near the top of the cycle and everybody in the Bitcoin space called him an idiot?
Who are the idiots now?
I’ll give you one guess.
I’m not saying we should have sold when Luke Gromen sold, I’m observing that a professional investor applied his framework and made a determination on when he should sell – and that gave him optionality that none of us “pureblood Bitcoiners” have, as long as we’re trapped in this “never sell” / Bitcoin-only mentality.
If I could sum up the above list in one pithy tweet, it would be the opening image of this mornth’s edition, by way of Nic Carter, who also found himself excommunicated from The Bitcoin Cathedral for indulging in shitcoinery.
Originally published on Substack.