Latest / What Bitcoin Did / EMERGENCY BITCOIN UPDATE: Coldcard Attack Explained | Rob Hamilton

Transcript

EMERGENCY BITCOIN UPDATE: Coldcard Attack Explained | Rob Hamilton · What Bitcoin Did

0:00
rob hamilton damn man crazy crazy 24 hours we have a legitimate emergency in bitcoin um what's
0:09
been going on um i in the spirit of emergency i'm just going to start this with if you
0:14
or anyone you know has used a cold card mk3 mk4 mk5 q any of those devices with any
0:25
wallets that were generated from the device you clicked give me some seed words
0:30
um you need to immediately stop what you're doing and contact friends this is a canceling of
0:40
weekend plans this is getting on planes for any ability for you to be able to recover your bitcoin
0:47
this is uh as about as code red as it can get for bitcoin self-custody as it relates to the
0:54
urgency in which you need to act um i will go more into the details with that urgency i want to
1:01
caution um slow is smooth and smooth is fast so you need to act very decisively and you need to
1:08
be able to act deliberately you should reach out to your friend networks and people that can help
1:14
you support um any questions you may have but time is of the essence right now so maybe we should
1:21
just start with what happened um because i first stop your podcast if you have to like you need to
1:26
stop like you but yeah this is not going now this is not a drill continue um and so i obviously first
1:32
saw this pop up on twitter yesterday um i actually had a cold card mark four that was using as almost
1:38
like a spending wallet but the amount in there had got to a point where i was like very uncomfortable
1:41
as soon as i saw this news i text you being like i've seen this thing with the mark three is overblown
1:46
or do i need to do something and again you were like this is not a drill you need to do something
1:50
now i wasn't with my wallet managed to managed to sort that out but this is like a serious product
1:55
a serious problem that's impacting a ton of people um where did it all start
2:00
so uh in early of 2021 there was a change to the cold card firmware as it relates to the
2:09
entropy that gets created and that is when a bug was introduced now uh since i will take a moment to
2:18
explain the nature of the problem um if you had uh an ear-gapped wallet never talked to the internet
2:26
it doesn't matter the things that would save you if you were using a cold card mk3 mk4 mk5 and q
2:35
is if you have a sufficiently strong 25th word passphrase if you also rolled dice or provided
2:47
your own entropy from outside of the cold card the nature of this bug is that when you turn on
2:52
a cold card and you have a clean device and you say this is amazing can you please give me
2:57
some seed words those are not secure so i want to be everything else needs to go down yeah
3:05
i just want to be really clear so that we don't miss anyone here you obviously said mark three
3:09
four or five or q what about the mark one or two if they were on updated firmware and they still
3:15
generate those keys after 21 uh to my understanding the mk2 is not supported in any of the impacted
3:20
firmware okay i'd have to go double check but the mk if you have an mk1 and mk2 technically
3:25
the firmware bug that we're talking about has not been introduced um because that is long end of life
3:32
hardware there aren't updates for that really anymore um and so if you have an mk2 or mk1 you
3:39
should not be impacted by this okay and then i think we should also be really clear on the pass
3:43
phrase because that's essentially a 25th word um at this point that's the only word really keeping
3:50
your bitcoin secure is that right if you really only used one word that is right which means you
3:56
are not secure you have to assume with what we're discussing right now is that many attackers not
4:04
just one person there are many attackers right now who are scanning to get the entire table of all
4:10
possible seed phrases a cold card could generate whether it was 12 words or 24 words and they are
4:16
sitting on all of those words and they are taking all of the low-hanging fruit of single signature
4:21
keys my assumption is they're going to move on to other things but we'll get to that yes
4:25
and and so the passphrase is is the only thing keeping it secure if you've done that you should
4:31
still probably move funds would you agree absolutely uh especially if it's one word so
4:35
like a one word password is not strong um there are different uh perspectives on exactly how to
4:46
mitigate this rather than if you're in the zone where you're kind of debating am i safe or not
4:51
you just need to stop what you're doing and uh recover your bitcoin before it gets stolen
4:57
um in theory if you had 12 like 12 random words that you added on top of that
5:02
Okay like you in a better spot but now your entire security model was oh an attacker needs my seed words and my passphrase And the seed phrase is now known by multiple actors at this point or will be imminently over the coming couple of days
5:19
if not like maybe a week.
5:20
But honestly, this is something that you need to move as fast as possible.
5:24
So the only way you're secure is if you create your own entropy
5:27
and doing that obviously comes with its own risk
5:29
that you have to do that very carefully, very consciously.
5:32
Is it kind of to the point where if you're using a cold card device,
5:36
just move off it for now?
5:37
wait and let the dust settle then see what happens um yeah like there there are a couple things so if
5:44
you have a cold card and you generated your own entropy there is no identified bug in any of the
5:51
firmware from the operations of anything else besides the generation of the seed now to be very
5:57
clear the most important thing a hardware wallet can do is give you a secure seat phrase yeah power
6:02
users will roll dice and do
6:04
other things to bring their own entropy
6:06
into it so it exists outside of the
6:08
cold card. Tragically,
6:11
exactly for reasons like this
6:13
of not trusting the cold card
6:14
and that you're not going to trust it to provide
6:17
that information reliably.
6:19
If you
6:20
have a very strong passphrase or you
6:22
roll dice, for the time being, there's no
6:24
urgent need to move as long as you're
6:26
very sure that you
6:28
rolled those dice.
6:31
To add to that,
6:32
for migrations and things to do.
6:34
That is, there's a longer conversation
6:37
we need to have there.
6:38
If it's a single signature,
6:39
specifically with the MK3,
6:41
you need to do that right now.
6:43
The MK3 is identified to have
6:47
two to the 32 bits of entropy.
6:50
Now, if you're familiar with seed phrases,
6:55
right, like these words,
6:56
is that there's a list of 2,048 of them.
7:00
And each time you can pick one,
7:01
you can even have them
7:02
sometimes be the same word each time you're basically picking 2048 multiplied by 2048 multiplied
7:07
by 2048 so if you take 2048 times 12 you're close to 128 bits of entropy which is really good and if
7:13
you do the 24 um you're at 202 to the 256 both of the like we're talking numbers that are in the
7:19
scope and size of there are more possible seed word combinations than there are atoms in the
7:25
observable universe and to explain why this is a problem the nature of cryptography and bitcoin
7:30
security ultimately is that everyone your bitcoin address ultimately in one way or another results
7:38
back to a large number some number between zero and two to the 256 that is the universe that is the
7:46
the universal proverbial needle in a haystack and the idea is not that someone can't know my number
7:55
it is for someone who doesn't know the number to be able to guess it they have to basically guess
8:00
all of the numbers in the universe and the universe will go through a heat death before
8:05
someone's able to get there with all of our modern computing right the problem with the cold card
8:10
firmware with this firmware change was with some of the changes i saw it succinctly summarized as
8:16
there was code that said hey use extra secure entropy um and then continue there was basically
8:26
a one-line error that just said oh does this function exist somewhere if so you can skip
8:32
the entropy and rather than is this function true right it was like a true false statement
8:39
and rather than it being is this true we should invoke that uh you can skip the entropy it was
8:45
like oh this exists so we can skip the entropy that's the best highest level it is one line of
8:51
code um of how i can describe this issue but the thing is with the mk3 since you have two to the
8:59
32 bits that is trivial for consumer hardware to be able to brute force all of the c phrases
9:04
the mk4 the mk5 and the q have updates to the firmware the those updates to the firmware
9:12
are not better in the sense of you don't have to worry about this they are extra entropy what
9:20
people in the industry are estimating right now somewhere between 45 and 50 bits of entropy
9:24
which is more that is a significant amount more extra protection but with someone with a data
9:30
farm of gpus they will get this information and now the people that know that money's being stored
9:35
on it it will be consumed rapidly and quickly so uh if you did not use a passphrase if you did not
9:40
use um a seed phrase like uh if you did not roll dice you need to right now stop what you're doing
9:47
and you have to treat those funds
9:49
as you're in a race against the clock
9:50
across many teams of hackers
9:52
who are going to get your Bitcoin.
9:55
So the obvious question is like,
9:57
how is this bug not spotted?
9:59
Like for me, like this is obviously
10:02
source viewable software,
10:03
but I can't read that code.
10:05
You can like, did you ever go through
10:06
and read the cold card code?
10:08
Like how was that not spotted early?
10:10
Yeah, I had gone through it previously.
10:13
I had gone through it with my own eyes
10:15
And I'd also had gone it through earlier versions of large language models.
10:20
And what I have observed and I think this is an important part of the story is the latest open source bleeding edge model Kimi K3 which is from China
10:33
It's an open source model, does not have the safety guardrails that OpenAI and Anthropic have.
10:38
And so when this incident started happening, myself and many people in the industry started looking exactly at where this would go wrong in the code.
10:46
And Fable would downgrade me.
10:48
So you can't use the leading model.
10:49
This is a cybersecurity thing. And then using OpenAI, it would kind of like be coy and generally nudge that something may be going on, but not tell me details. I put it into Kimi K3 and it instantly just read out the entire incident and exactly what went wrong.
11:04
and so uh there is something to be said that for a long time uh security through obscurity was used
11:13
in places and that is no longer possible if the code exists and people are able to walk through
11:17
and see it it will be exploited it's um so when i first saw this i assumed that it was a
11:24
lazarus north korea type hack very sophisticated but i've read some stuff online that says it's
11:29
maybe a bit of an amateur doing this doesn't really know exactly what he's doing but still
11:33
managed to exploit this bug the first the first attacker was i would say an amateur um there's a
11:38
lot of on-chain heuristics of what you could tell in the movement patterns they only moved bitcoin
11:45
addresses that were more than 0.15 bitcoin why someone wouldn't run a little extra logic and just
11:51
get 0.1 bitcoin at six thousand dollars for no extra cost really that's weird they did not properly
11:59
scan full addresses so people were getting hacked and they still had funds that were sitting in the
12:06
addresses was that i did see something about that was it because it was only looking at like the
12:09
first 200 utxos or something like that it was looking uh what it was doing is looking for the
12:15
first gap so if you create an address and you didn't use it and then you made another address
12:23
and you use that second address the moment the bot saw that there was no more addresses it stopped
12:27
looking uh and this is initially would have kept you safe but this is going back to the point now
12:34
there are multiple attackers now executing this and i'm assuming they're getting more and more
12:40
sophisticated so like that's it and that's why you can see different on-chain movements and seeing
12:46
different wallets being used um different transaction behaviors you can just tell by
12:51
some basic fingerprinting that different actors are going about this that makes sense so but this
12:56
is something you can do trivially like i could do it on my laptop if i had like the skills yeah
13:00
uh there are reports of white hat hackers which is people who are trying to do it for the good
13:05
who started seeing this exploit started running code and came into dozens of bitcoin and they
13:11
swept them because they were trying to do they'd rather at least try to find a way to give it back
13:15
to the right owner and then try to uh let an attacker take it so people will be in a panic
13:22
hearing this if they're using a cold card.
13:25
I want to talk about some of the other devices
13:27
because cold card was initially like a fork of Trezor.
13:30
And since then, Foundation has forked cold card.
13:34
Are those other forks from the same thing safe
13:37
from the same original source code?
13:38
Yeah, neither Trezor nor Foundation
13:41
use the library that was compromised with the cold card.
13:44
Okay, so basically anywhere is safe
13:46
apart from cold card right now.
13:47
This isn't like a broader self-custody attack.
13:49
This is a specific cold card.
13:50
The use of this library was specific to cold card or realistically mainly cold card.
13:55
So what should people do if they're panicking right now?
13:57
Where should they be moving funds?
14:02
This is something that is for each individual person to kind of make that judgment call.
14:09
I am, while I am the co-founder and CEO of AnchorWatch, I want to be fair to everyone
14:14
and talk about how I would console someone if I did not run this company.
14:18
and I was trying to help a loved one through this.
14:21
If you had used a Bitcoin exchange
14:23
and your Bitcoin is, you know, in the system,
14:26
you give an exchange dollars, you get Bitcoin,
14:29
you withdraw it to self-custody.
14:31
Immediately short-term,
14:33
sending it back to that exchange is not a bad idea
14:35
if you have no better place to do this.
14:38
I'm a big fan of River, personally.
14:40
I have high confidence in the infrastructure over at River
14:42
if you're looking for a good Bitcoin exchange.
14:46
I'm talking to other people in industry.
14:47
I just know that River runs their own custody.
14:51
They're not outsourcing it to someone else.
14:52
And I think that's an important thing to be aware of, and they do proof of reserves.
14:58
I think really genuinely proof of reserves is kind of table stakes if you're going to leave your funds out in exchange.
15:03
And River is the main place that does that.
15:06
As it relates to other options, now, you could, in theory, go to a Best Buy and pick up a ledger in the States today.
15:17
You can get bit keys there as well.
15:19
You can get bit keys as well.
15:21
Those are good immediate emergency options to get things set up properly.
15:28
And to be clear the whole context of this advice is your funds are imminently going to be hacked if you on a cold card without the entropy and without the dice and without passphrases So my advice is not set this up and hang out for the rest of your life This is
15:42
you need to do something in the next 24 hours. Now there are other services like there are
15:50
Unchained, there's Casa, there's us at Anchor Watch, there's a Swan Vault as well. There are
15:55
many products across the industry that offer these things in collaborative custody. I think those are
16:01
all great measures to be able to provide extra support to people um if you have a friend um we
16:08
won't say who but as we were starting this podcast you and i got a call from a mutual friend who was
16:13
basically breaking into a friend's house who was on vacation and getting this pin over the phone to
16:20
then move the funds before they got hacked uh they had a reliable self-custody wallet to be able to do
16:29
that right um the universe and space of this has to be very carefully thought out and this goes back
16:36
to um something i believe i said before is that um slow is smooth and smooth is fast so you need
16:43
to have a decisive plan that is good enough for the trade-offs right now and decisively execute
16:48
you do not have days to really war game out your optimal option here it's just most important that
16:55
you take action now there's so many things that are very unfortunate about this um from a user
17:01
perspective like one of them especially comes down to sort of privacy um because if you're in a panic
17:05
now you might have a ton of utxos on a cold card some of which may be like non-kyc bitcoin stuff
17:10
that you don't really want to mix but at this point you kind of just have to move everything
17:13
together like that's one of the really unfortunate outcomes indeed yeah uh while you could if you
17:22
are technical enough spend the time building a careful transaction graph i'm going to assume most
17:28
people aren't and so you have to make a cost benefit analysis for your own position to understand
17:35
is that with any of these movement options and how you're going to execute about them you are the
17:40
best person to be able to understand your circumstance and that's why i try to keep the
17:44
advice very open-ended in general to meet different people depending on where they could be in their
17:50
self-custody journey and their Bitcoin journey and their technical competency.
17:55
And then the other side of that is the thing that is very harsh about this situation that's
18:00
completely unlike a Mt. Gox or an FTX is that the people that have been affected by this have done
18:05
everything so right. Like they've taken the time to learn self-custody. They've bought what was
18:10
sort of perceived as the most secure Bitcoin hardware wallet. They've done everything correct
18:14
and they've still been fucked in this situation.
18:19
Do you think this sets back Bitcoin self-custody
18:21
in a significant way?
18:30
I think it would be naive to say
18:35
that in the short term
18:36
that there's going to be a massive re-evaluation of this.
18:40
many people lost their life savings because of this um i think it's important for bitcoin
18:49
as a technology as people who send and receive bitcoin regularly to be thinking about
18:58
where to go from here uh the capturing of bitcoin as a decentralized network
19:04
is accelerated if the only place you can hold it is at a quality like a specific exchange that is
19:12
inevitably bitcoin is freedom money cannot work if you're not able to freely be able to
19:18
call your money and own it and touch it yourself now
19:23
i think there's a this is so pressing and breaking it is difficult for me to come out
19:30
with my prescriptive list of these are the things we should be thinking about and doing
19:34
I think most important right now, what we should be doing is informing people, letting them know that this is happening, giving them ideas for contingencies.
19:43
There's a couple of more threat models I do want to go over for maybe more advanced users as it relates to ways that your funds could additionally be put at risk.
19:53
and i'm going to start there because i think that's actually more important than like the
19:59
bigger question is if you have a multi-signature wallet and they are only using cold cards and
20:06
those cold cards are only generated using this entropy your funds are at risk and you need to
20:11
immediately make whatever moves you need to do to get that fixed if you have let's say a two of three
20:20
and you have two cold cards in a ledger
20:22
and you did not do the passphrase
20:24
and you did not do the dice rolling,
20:26
your funds are at risk
20:27
and you need to make moves immediately to rectify that.
20:30
Now, to explain,
20:32
I feel fairly confident this is what's going to happen.
20:36
Can I ask you a question on that part first?
20:39
So you said if you have a two of three
20:41
and say one device is a ledger,
20:43
one device is a Trezor,
20:43
one device is a cold card Mark III,
20:46
even in that situation, your funds are at risk?
20:48
No.
20:48
So if you have...
20:49
a treasure, a ledger, a cult card,
20:51
your funds are not at risk.
20:52
If you have two cult cards and a ledger,
20:55
your funds are at risk.
20:57
Yeah, because those two can...
20:59
Yes, and this is to get a little bit
21:02
for those that need to know,
21:03
because I have talked to...
21:06
I've probably talked to at least
21:07
a half dozen people specifically
21:09
in this situation, if not more,
21:10
where they have two cult cards and a ledger
21:12
or two cult cards and a treasure
21:13
or two cult cards and a jade
21:15
or two cult cards and a foundation device,
21:17
whatever, two cult cards and a seed signer,
21:19
right the necessary thing to understand is that when you go to spend bitcoin in the bitcoin network
21:30
let me actually just take a half step back here what is going to very likely happen across multiple
21:35
uh hackers is they are going to build an entire list of every single seed phrase combination that
21:40
the cold card would do without entropy what they are going to do from there is they are going to
21:46
start realizing, wait, if I have all these seed phrases, I can actually see if my wallet's being
21:51
used on chain. And they're going to say, okay, out of this, you know, billions, we're going to say
21:57
that we have this many that could be in use at the moment. They're going to look at those and
22:03
they're going to see what are they doing with it. And to be clear, if you use your cold card
22:08
in a multi-seg, they can see, wait a second, that person spent from this address and that public key
22:14
is tied to my list of seed phrases here.
22:17
They're going to be able
22:18
to basically monitor your wallets.
22:21
Here's what happens.
22:22
If you have reused addresses,
22:24
those reused addresses have the raw public keys
22:27
of how you spend that Bitcoin sitting on chain.
22:30
And if it's a two of three and the attacker says,
22:32
oh, I have key A and key B,
22:34
they'll just take the funds.
22:35
They don't need to wait for you to do anything.
22:38
If you have not reused addresses,
22:41
you are in a very delicate position
22:44
and this is a little bit advanced and i want to be clear this is a very specific circumstance
22:49
if you have a multi-signature wallet and that multi-signature wallet is a majority for the
22:55
threshold uh cold card signers that are impacted by this issue you should look into using something
23:02
like mara slipstream and the reason why is when i go and broadcast a transaction to the bitcoin
23:08
network anyone on the network can see the transaction data before it gets confirmed but
23:13
it's not in a block yet which means an attack by flea exactly so an attacker will be able to
23:18
replace by fee and change the address from your address to an attacker's address if you use
23:22
something like mara slipstream you will be able to have it broadcasted to a mining pool that has
23:28
over five percent network cash rate they find multiple blocks a day and it will just appear
23:33
confirmed on chain which will mean the attackers will not be able to do anything and so i know it's
23:39
a very specific circumstance but i've talked to easily a half dozen people who are in this exact
23:43
position and you can reach out to mark like there are ways for you to be able to do that um
23:48
if you only have cold cards if you have a three of three if you have three cold cards and it's a
23:54
two of three they will find your funds they will look at all the seed phrases and once they have
23:58
all the possible seed phrases they're going to run through all of the common metrics of different
24:02
multi-sig thresholds among those keys if they haven't already been spent on chain if you've
24:06
spent from your multi-sig address once on chain they will be able to trivially scan and see that
24:11
it's there and be able to attack you um and know that yeah so in that situation slipstream doesn't
24:18
help you so what do you do you just have to set an incredibly high fee rate and hope you just have
24:21
to go you just have to rip it you you don't have a yeah so if you've and to explain this let's say
24:27
you have a two of three multi-sig and they're all cold cards you and you've spent from it before
24:33
attackers will be able to see oh key a key b key c that matches seed one two and three boom boom
24:41
connected i'll be able to move my funds so if you have a an n of n two of two three of three whatever
24:48
multi-sig wallet that is only cold cards that are impacted by this issue you need to move funds
24:53
right now like you you are marginally safer than a single sig and the reason why is because you need
25:00
to have an attacker know all of the seeds in the universe to be able to attack it but that is a
25:05
ticking time that you're racing against the clock you need to immediately make moves if that is the
25:10
position you're in oh it's such a terrible situation to be in um do we know how much bitcoin's been
25:17
stolen from this attack so far i saw yesterday it was like 600 but i'm sure it's increasing it's
25:21
over 1100 at this point and there's probably more clusters going on all the time um i occasionally
25:26
was poking around the men pool to see if i can find more things it's going to be thousands of
25:28
bitcoin before this is done and it's going to happen in waves what i'm describing right now
25:32
this race against the clock the lowest hanging fruit were hit and that was probably one attacker
25:36
the starting gun has been fired off the everyone has declared the emergency every black cat hacker
25:45
on the internet with an llm is going to be able to start poking around seeing what they can find
25:49
they and because there are multiple attackers now there's a an inevitable outcome where well
25:56
capitalized ones are going to come in spend millions and millions of dollars on graphics GPU computing because they know that they can pop one vault what you be able to have an attacker do is
26:08
they're going to be able to look through the full list and just pop it right out and you are just
26:12
marginally safer because it's not the lowest hanging fruit but you are not safe period
26:17
so this started as obviously like an amateur attack as we spoke about a little earlier
26:22
but this is now you have to assume the best attacks in the world are now having a go at this
26:26
yeah this is everyone
26:29
it's a it is a real mess
26:33
so when you compare this to like a Mt. Gox or a FTA
26:42
the number of coins is going to be far lower
26:44
but is the damage going to be greater
26:47
because it kind of arose people's trust in self-custody essentially
26:50
like cold card was the golden child of Bitcoin self-custody essentially
26:53
i like i said earlier it would be naive to say that in the short term that this is not going to be
27:02
a uh a very negative downward pressure on self-custody and for i know multiple people
27:09
who've lost either some money or their life savings uh i have spent the past 24 hours i have
27:17
talked to directly on a one-on-one context dozens of people um in a larger platform i've talked to
27:25
now thousands of people trying to raise the alarm bell about this and the stories keep on coming in
27:33
this this will have a downward trend on self-custody i think that doesn't have to be the
27:42
end of the story but i think there needs to be as the post-mortems wrap up and we do a full
27:47
debrief of this the entire ecosystem has an opportunity to build from here and find improvements
27:56
um we are now almost 30 minutes into the podcast so um in some conversations people are talking
28:06
about we need covenants and vault-like structures yeah things that can improve self-custody my
28:12
biggest concern for the health of Bitcoin as a network is that the default option being holding
28:16
it at a custodian or an ETF wrapper. I am not opposed to those instruments existing. I think
28:21
those are inevitable structures that happen with hyper Bitcoinization. But the value proposition
28:26
of Bitcoin itself will be diminished greatly if those are the only real options. And being able to
28:33
to explain this, the way Bitcoin works today, if you have the requisite amount of signatures,
28:40
you can send any amount of Bitcoin anywhere within reason.
28:44
There's weird corner cases,
28:46
but let's just say for the sake of conversation, that's true.
28:49
Things like covenants would allow you
28:52
to be able to have things like,
28:54
I only want to be able to send to these addresses.
28:57
I only want to send this much Bitcoin.
28:59
This is something at AnchorWatch
29:01
we are able to offer as a product level service, right?
29:04
It is an application that sits on top of Bitcoin
29:06
where we say AnchorWatch is a required co-signer
29:09
to move funds but we will in exchange for like us being able to help you out we'll say okay well
29:18
you only can send to the addresses you give us so addresses a b and c otherwise we at anchor watch
29:22
won't sign it's effectively a covenant as us acting as a cosigner gives that feature or i only
29:29
want to send one bitcoin a month that's something we can do at anchor watch it's something you can't
29:34
do on the bitcoin blockchain level if it were to be democratized to the bitcoin blockchain level
29:39
anyone in their basement would be able to have orders of magnitude better security
29:46
than any of the enterprise leading custodians today and that's an important point because
29:52
when bitcoin is in flight once it gets confirmed in a block it's over whereas with covenants and
29:59
in general vaulting you would be able to send to like a staging address so you'd be like wait a
30:03
second why did my funds move it's sitting in my staging address and then you can pull the emergency
30:07
ripcord to like pull the funds out now it doesn't solve the key management problem
30:13
right i think it's an important thing to call out that it is a mitigation it is necessary but not
30:20
sufficient to be able to improve these things but the ultimately you need to send bitcoin to an
30:26
address somewhere and those addresses have to ultimately be tied to keys so there is a lot of
30:32
learning, I think, within the ecosystem about where do we go from here. And I think there'll
30:41
be plenty of time to discuss that in the coming weeks after the initial incident response and
30:46
everything can be done as much as possible to keep people safe. Right now, I think the main focus is
30:51
just letting everyone know this is happening and they need to immediately remedy this if they're
30:56
impacted how do these um there's a thing like an unchained or a cassette let's say you have a two
31:04
of three with one of those um if i have so one key will be on your phone generally one key will be held by the company one key is held by you If I holding my key let say on a cold card how do I know that the counterparty
31:20
the unchained or the CASA is not?
31:23
The unchained or the CASA counterparty is not what?
31:28
Like holding one of their key on a cold card
31:30
because that would then put the multi-sigual risk.
31:32
You can't prove that.
31:34
You can't with any wallet wealth in a very tragic sense of irony.
31:42
Very soon people will be able to prove if they were using the cold card keys because attackers will have them.
31:48
Right.
31:50
The ideal structure, though, is that it's not something that can be an issue.
31:55
because if you have sufficient randomness there's no you should not be able to fingerprint and say
32:01
oh that that x pub came from a ledger and that one came from a jade that would be a breaking in
32:06
the underlying cryptography assumptions that is a truly random number that is seeding all of your
32:12
secrets so i guess the point i'm trying to make i'm trying to make people feel comfortable here
32:17
if they are using a castron unchained like have either of those made a statement about how they're
32:21
generating their keys?
32:22
Because I'm convinced
32:24
that neither of those companies
32:25
are using the on-device
32:27
random number generator.
32:29
But have they made
32:30
any statements about that?
32:31
To my understanding,
32:33
Unchained has made a statement.
32:35
I believe Casa has made
32:36
a statement as well.
32:37
And we at AnchorWatch
32:38
have also made a statement
32:39
that this does not impact us.
32:41
And so I think it's an important thing
32:45
to look in your vendors
32:46
to see if this is an issue.
32:48
I think that's a very reasonable concern.
32:51
but i think everyone at this point has made some public statement to the effect of that
32:56
i'm not aware of any i'm not aware of any bitcoin business even through like
33:00
hushed private circles who are impacted by this i haven't heard anything yet they may exist but i
33:05
have not heard anything i i definitely don't want my words to be twisted there like i think a cast
33:09
for an unchained like anchor watch i'm sure all those companies are set up brilliantly um i just
33:13
i just want to try and make people comfortable with moving funds to those places if they need
33:16
understood um anchor watch how do you set up your multi-sig uh yeah so the nature of what we do it's
33:25
somewhat different is we use what's called mini script and that allows us to do more advanced
33:31
scripting functionality uh rather than just a two of three we are able to say we have a two of three
33:36
you have a two of three we all have to get together and sign and move things we could do is we have a
33:41
Two of three and you have a single key, right?
33:43
And we act as that cosigner still, right?
33:46
The nature of how anyone generates keys is an extremely sensitive thing because you just need to keep that on a need to know the exact mechanics.
33:58
But our process has been peer reviewed.
34:02
There are many, I think most actors in the industry have their own very rigorous key generation ceremonies of what they go about for being able to.
34:11
evaluate that so when like i really like single sig self-custody like i think i think you should
34:19
have different trade-offs for different amounts of bitcoin that you're holding like if maybe you
34:22
have one sort of deep cold storage which is geographically dispersed multi-sig and that's
34:26
great but the simplicity of single sig is really important too i think i i would definitely still
34:32
use that occasionally um how do people think about that going forward because i've always i've
34:38
always said that like the most likely you are to lose bitcoin is through your own complexity in
34:42
your own setup like complexity being the enemy of security and do you think people are going to make
34:46
the mistake now of jumping too far into multi-sig because they're scared of this attack and actually
34:50
add too much complexity to their own setups i think multi-sig is no longer that complicated
34:55
i think this is not 2017 anymore um additionally if for whatever reason you want to do a single
35:01
signature you could do single signature with a passphrase that effectively is a two of two
35:05
multi-sig because you have to have both pieces to be able to constitute a spend if you were doing
35:11
that with a reasonably strong passphrase going into today you're still safe i would still make
35:16
a new wallet because if you fell under this and your initial 12 or 24 words were actually part of
35:23
this hit of known possible seed phrases all that's keeping you safe now is your passphrase
35:30
but uh i think there's a lot of opportunity for everyone to grow and learn from this to even
35:37
further improve the user experience because this will this will be in the front mind of anyone
35:44
who discusses self-custody for a very long time so this is the first like in the wild case that
35:51
we've seen of ai essentially hacking and taking down a bitcoin self-custody solution um do you
35:58
think this is the start of that era do you think we're going to see more and more attacks like this
36:01
i think in general uh across the whole web there are going to be more and more attacks like this
36:06
um the trivial ability for me to be able to open up to open router and use kimmy k3 and point at
36:12
the cold card firmware and instantly read out everything everyone needs to be and we regularly
36:20
do this at anchor watch i know most companies that i know of in the bitcoin industry are regularly doing this and kind of defensively trying to deploy these tools to find things
36:32
We've always found, we've never found anything that was a money losing bug.
36:37
Nothing in the universe of bad of what we're seeing here with the cold card.
36:41
But you find bugs.
36:43
The software has bugs.
36:44
It always will have bugs, right?
36:45
Like there is some emerging research around things like formal verification.
36:51
So you can actually do formal mathematical proofs as to how code executes.
36:57
That's an emerging field of research that I think may get more important over the coming decade.
37:01
But software is written by humans and humans inevitably have bugs.
37:05
And even LLM sometimes have bugs, right?
37:07
You don't want to be blindly passing everything you've built to just have it go get figured out later by LLM.
37:14
And the LLM may not be complete, right?
37:15
The rapid development of these models, there's a kind of a funny software motif.
37:19
If you like VibeCode a website and you launch it, in three months, the new model comes out and it says, wow, this code base is a mess.
37:27
Let me fix this for you.
37:28
And that's just been happening continually for two years now.
37:30
So like we're at a place and a time where you need to be hypervigilant with your own individual judgment, with your ability to understand the nitty gritty details of risk and however it emerges to be able to keep you and people you work with safe.
37:47
All right.
37:47
Awkward question time.
37:48
because i know you're friends with mvk but like the blame obviously ends with them but how
37:54
incompetent was this because this has been five years that this firmware issue has been there
37:59
uh not acceptable as a starting place like not like there is no yes i've i've known mvk for a
38:08
long time um there is no excusable there's no set of circumstances that excuses this the the one job
38:18
a hardware wallet has,
38:20
if it were to have a single job,
38:22
more important than all of the other jobs
38:24
is that it can securely generate
38:27
a sufficiently large random number
38:29
with sufficient entropy.
38:31
That is the entire game
38:33
in which everything else gets derived from.
38:35
There are bugs that have happened
38:37
in hardware wallets in the past
38:39
where maybe how they signed a transaction
38:40
wasn't secure.
38:42
And then basically,
38:44
if you reused addresses,
38:44
you could lose your funds.
38:45
Or maybe you would have bugs
38:47
where it wasn't checking the change address.
38:50
So if I sent you Bitcoin,
38:51
if I have 10 Bitcoin,
38:52
I send you one Bitcoin,
38:53
I have to send myself nine back in change.
38:55
There were bugs in software and hardware wallets
38:57
that didn't check the change,
38:58
which was the most important part
38:59
of the transaction in that sense, right?
39:01
This bug is so foundational
39:02
to the actual security of Bitcoin
39:04
that it is a nuclear event, right?
39:11
This is the most catastrophic thing.
39:13
That is why someone could be entirely air-gapped,
39:15
never have talked to the internet,
39:17
and someone's able to peer through the vast space of randomness and get your Bitcoin,
39:21
which should never happen.
39:25
Do you think it's at the end of cold card?
39:29
Do you think they'll be able to recover this?
39:30
Because trust is everything when it comes to these devices.
39:32
It is.
39:33
I think it's too early to say.
39:36
I don't know.
39:37
I'm not a lawyer.
39:38
I don't understand any of the liabilities or fallouts or all of these things.
39:44
it's hard for me to say.
39:48
Yeah, truly.
39:48
I don't know.
39:50
All right, Rob,
39:50
I appreciate you doing this
39:51
so last minute.
39:52
I wanted basically
39:52
just to get this out there.
39:53
If one person listens to this show,
39:55
they're not permanently
39:56
on Bitcoin Twitter
39:57
like you and I
39:57
and they haven't seen this news,
39:58
like that makes it 100% worth it.
40:01
Any closing words
40:02
for everyone who's listening?
40:04
Closing words again.
40:05
If you or someone you know
40:07
has used an MK3, MK4, MK5, Q,
40:12
any of those cold card products,
40:13
without either rolling your own dice
40:18
or having a sufficiently strong passphrase.
40:20
And if your question is,
40:21
is my passphrase strong enough?
40:22
It means you don't understand the entropy,
40:24
which means you need to go fix this immediately,
40:26
even if it is, right?
40:27
You just, if you don't know for a fact,
40:30
oh yes, I have this many bits of entropy in my passphrase
40:32
because you are super in the details.
40:34
Your passphrase is not strong enough at the moment.
40:36
You need to immediately make any moves and plans.
40:39
You need to cancel your weekend plans.
40:41
You need to get on a plane if you have to.
40:43
You need to call a loved one who may be able to help you out remotely.
40:46
This is a full five alarm fire.
40:51
This is all hands on deck.
40:53
I think everyone in the Bitcoin community has been trying to help through back channels and through direct messages, through being able to have people call you, find people, get connected to people.
41:03
My DMs are open on Twitter.
41:04
Like I said, I've talked to dozens of people across the whole ecosystem.
41:08
None of them even Anchor Watch customers because Anchor Watch customers don't have an issue at the moment.
41:11
Like this is not related to anything of how your funds are being kept safe at Anchor Watch.
41:18
So all of that to be said, like reach out to those you may know, people you've ever referred to using a cold card and do what you can to try and help them out.
41:31
And I think there's going to be an opportunity in the coming week, two weeks, to when the initial...
41:39
race is over. We can focus on triage. We can focus on, well, once we move beyond triage,
41:47
we can start focusing on where does the industry go from here. All right, Rob, I appreciate you,
41:52
man. Thank you for all the work, helping people out on this terrible, terrible event, but
41:56
Bitcoin will get through it, man. Thank you. Thank you.
42:09
Thank you.