The Coldcard Bug, Visualized
Video description from Youtube: Randomness is the entire security model of a Bitcoin wallet.
Imagine every possible Bitcoin seed phrase as individual atoms. An attacker would need to find the one atom that opens your wallet. When a seed is generated properly, the pool of possibilities is so large that the attacker is hunting for one specific atom hidden somewhere across two billion galaxies. No computer on Earth can search that many possibilities.
Affected Coldcard firmware drew its seeds from a much smaller, more predictable pool. Representing every possible Coldcard seed as an atom, the whole collection would only be about the size of a large virus. A computer can work through every seed in about three hours.
This short film travels that entire distance, from a single atom to two billion galaxies and back, to show what the difference actually looks like.
The stakes for affected users are real. Losing funds you did everything right to protect is a hard thing, and you deserve clear answers. Our thoughts are with everyone impacted as this unfolds.
BPI's policy reflections on this vulnerability are coming soon.
This video is a simplified search-space comparison. It describes affected firmware only, not all Coldcard devices or Bitcoin itself.
Chapters
0:00 What a seed phrase protects
0:33 Where randomness comes from
0:55 One atom
1:15 A protein
1:29 A large virus, about three hours
1:55 A grain of sand
2:02 Jupiter
2:10 The Milky Way
2:19 Two billion galaxies
2:43 The comparison
The Bitcoin Policy Institute is a nonpartisan, nonprofit research organization providing policymakers with research-driven insights on Bitcoin and digital assets.
