source avatarEvan Luthra

Share

THIS IS HEARTBREAKING!!!💔 A man just lost 10 years of savings in one night, and he did everything right. He posted on Reddit yesterday. 1.27 Bitcoin, stacking since 2017, living in a third world country where he says it's more money than he will ever make. He bought a hardware wallet and held his own keys, which is exactly what all of us told him to do. $70 million got drained from wallets like his in 41 minutes last week, and the attacker never touched a single device. The cause was a firmware bug in ColdCard wallets going back to March 2021. Some devices were generating seed phrases with weak randomness, so it's like buying the best safe in the world and finding out the factory shipped it with a few hundred possible combinations. The attacker worked those combinations out from home and swept around 1,200 wallets in under an hour. The devices stayed offline the whole time. The seeds they created on day one were the weak point. So if you generated a seed on a ColdCard any time since 2021, updating the firmware alone does nothing for you. You need a fresh seed on patched firmware and you need to move your coins to it today. And if you're holding serious money, go multisig with devices from different companies, or at least add a strong passphrase, because the wallets with passphrases and dice roll seeds survived untouched. I've been scammed, I've been drained, I've been phished. I keep a scam budget every year because some years this space charges you tuition. You pay it and you get smarter. Bitcoin still takes power away from the banks and gives it back to the people. Nobody warns you that the bank also had a security team, and now that team is you. So check your setup this weekend. Do your own research, talk to people who know more than you, and don't assume the box on your desk did its job perfectly. I learned that one the expensive way.

No.0 picture
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information. Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.