Coldcard wallet seed flaw exposed

Coldcard wallets had a seed-generation flaw since 2021, leading to $116M in losses across 5,200+ addresses by Aug 3, per BIT report.

avatar

A 69 year old woman hit a casino jackpot. Within minutes, state troopers arrived, walked her off the floor, and handed her a criminal citation instead of a check. – A 69 year old woman from Asbury, New Jersey, had voluntarily placed herself on Pennsylvania's lifetime gambling self-exclusion list back in 2019. – Self-exclusion is meant to be a firm safety net – Once you're on the list, Pennsylvania casinos are supposed to identify and turn away that person at the door for the rest of their life. – On a Sunday in June 2026, she was playing at Hollywood Casino in Grantville, Dauphin County, and hit a slot machine jackpot. – Casino staff or systems flagged her as a match for the self-exclusion list, and state police were called to the property. – Troopers arrived and physically escorted her off the casino floor. – Under Pennsylvania Gaming Control Board rules, anyone who violates their own self-exclusion has their winnings automatically confiscated – No partial payout, no refund of what they wagered. – Beyond losing the jackpot, she was also issued a non-traffic citation for criminal trespass, since being on the self-exclusion list makes her legally barred from the property entirely. – It's not publicly clear whether casino security failed to catch her at check-in, or whether she found a way around the system. She banned herself from ever gambling again, for her own protection. Seven years later, the system that was supposed to stop her at the door only caught up with her after she'd already won and the punishment for winning was a police escort and a criminal citation.

avatar

We’ve been told for years that hardware wallets are the safest way to store crypto. Then the last few weeks happened: > Coldcard wallets got drained > Trezor data leak > SafePal data leak I’m speechless🤫

avatar

🚨 #SafePal revealed a data breach exposing order info (names, addresses, purchase data) of ~39,800 customers due to an authorization flaw in its order tracking system—though seed phrases, private keys, and payment details weren’t compromised. #DataBreach #Cybersecurity

avatar

i installed a usb passkey, now i have to crawl under my desk and touch it everytime i need to login somewhere, has this world lost its mind?

avatar

Crypto security has a blind spot we still underestimate. Your seed phrase can be perfectly safe while your identity becomes the attack surface. @SafePal disclosed that an authorization flaw in an order tracking plugin exposed names, emails, phone numbers, shipping addresses and purchase details for about 39,798 customers. Private keys, seed phrases and funds were not compromised. And that distinction matters. The next attack does not necessarily start by breaking the wallet. It starts with knowing exactly who owns one. Once an attacker has your name, address, phone number and hardware wallet purchase history, phishing becomes much more convincing and physical security becomes part of crypto security too. Self custody is not only about protecting keys anymore. It is about minimizing everything that can be connected to those keys. The wallet can be offline. Your metadata is not.

avatar

🚨UPDATE: SafePal confirms that personal data of 39,798 customers was exposed. Your funds, seed phrase and private keys are safe, according to SafePal.

avatar

Fuck, what the hell is happening? Ever since ZachXBT said that, one incident after another: Coldcard, Trezor and now SafePal. Buying a hardware wallet is now an IQ test.