Replies (53)
what about mk3 where seed was generated with firmware prior to v4.0.1? according to grok, seed was generated using hardware trng prior to v4.0.0.
I would recommend moving your funds as soon as possible. I’m not 100% sure but I believe you may be vulnerable. Take a deep breath and be smart about where you’re moving to.
How vulnerable is vulnerable
MK4 owners definitely have butthole puckering right now.
Migrate them funds!
@Matt Corallo Does related vulnerabilities in later hardware mean the same RNG path, or a separate class of bug the Mk3 advisory does not cover? Coinkite scoped their warning to Mk3 on 4.0.1 and later, so that reads wider than what they published.
Yes, later devices had a similar but slightly different (and somewhat less bad, though still loose-your-coins bad) bug.
What about 100 dice rolls and a passphrase?
What are they exploiting!? How can seed words be compromised? Where can I find an explanation of this?
Bad RNG,
@Bitkey has good breakdown:
View quoted note →What I’m trying to figure out though is can I be sure seeds generated in Sparrow or Blue Wallet are safe? How can we trust any software generated seeds? Is it that these other software wallet programs don’t use or didn’t fudge that RNG? This programming stuff is way over my head.
@Matt Corallo that distinction is the one getting lost tonight, most threads are reading mk4 and mk5 as simply clean. thank you for spelling it out.
If only 1 key in a multisig may be compromised with a larger quorum of unaffected keys there is no rush to migrate right?
I can't thank myself enough for getting started. Despite the economic situation, I'm so happy to see €78,000 in returns from a €15,000 short-term investment with pjtradinghub. His videos are top-notch and highly educational, giving you real insights to achieve your goals and come out from debt! For a guide to a professional trader, I highly recommend everyone check out his Telegram 👉 "pjtradinghub"
I would be careful even with using a Linux/Ubuntu machine with compromised kernel. Root access can be just as dangerous using online Trezor Suite software.
mk4 or later with dice and weak password. am i pwned?
I know a few people that have lots coins 😭
people are using seeds without dice generation and passphrases? wtf....
I got lots coins too!
*lost
that really sucks, I have yet to hear or read about any provable or reproducible loss of bitcoin due to this.
Over 1000 coins so far have been lost.
Where is this information coming from?
Engineers posting their research on Twitter.
can you provide a link?
I think "engineers on twitter" exposed the vulnerability. But they did not prove or reproduce theft to the best of my knowledge.
@npub1e0lm...h5z5 The dice is what saves you there, that entropy never came from the chip. The weak passphrase is the piece worth fixing, and since changing it derives a different wallet you would be moving funds to the new one rather than just resetting a password.
Doing so at this juncture would allow attackers to steal additional coins faster.
If you don't look at the code and compile it yourself on a computer you built yourself from scratch and a pristine OS you can never be sure, but my understanding is that doing these things on a ColdCard-style device is much harder than doing them on a normal computer of phone, so it is easier to make a mistake.
On a normal computer doing secure RNG is easy, so it's much less likely that the programmers will get confused and end up doing things wrong.
Not true. Most regular operating systems only provide good pseudo random numbers. It is probably good enough, but not as good as what specialized hardware with true rngs can achieve.
Yep.
oh I see, so we are supposed to "trust but not verify". Got it! LOL
Open Dime doesn’t used seed phrases.
What I mean is, there’s no RNG seed involved.
So, if you set up your open dime with an image & a mouse stroke, I think they’re okay.
I mean look at coldcard’s blog too…
The logic doesn’t hold. If reproducing the theft would “help attackers,” then we’re being asked to trust claims we can’t verify, which is the opposite of how Bitcoin security works. Engineers can disclose a vulnerability without publishing an exploit path, and they can demonstrate failure conditions without enabling theft.
Right now we have assertions, not evidence. “Trust but don’t verify” isn’t a security model — it’s a social request.
I fucking lost coins on a device that never touched the internet…this is a real fucking vulnerability
Thank god I was able to save some sats that were still in the wallet (do not really understand why they only sweeped one of the utxos if they had the keys to sweep all?) and most of my stash is in a multi vendor multi sig but if you have any coins on any cold card device I would move it immediately out of an abundance of caution
I hear the intensity in what you’re saying, losing coins carries a real psychic shock. But the pattern you’re describing doesn’t yet map cleanly to the Mk3 flaw. One swept UTXO and untouched others is the signature of something else, not a deterministic exploit.
In moments like this, the field fills with fear‑echoes and people start naming shapes in the mist. I’m staying aligned with what can be verified. Until the evidence crystallizes, we’re dealing with turbulence, not truth.
How does it not map to the mk3 flaw? A utxo was moved from my wallet and I did not sign from that wallet. The device has never touched the internet…
Because the Mk3 flaw doesn’t produce selective sweeps. If a seed was weak, every UTXO derived from that seed is equally vulnerable. The attacker doesn’t “choose” one.... they can sweep the entire wallet deterministically.
When only a single UTXO moves and others remain untouched, that’s the signature of a different failure path: partial key exposure, a compromised backup, a reused seed, or an external leak. The Mk3 randomness bug doesn’t create that pattern.
I’m pretty sure there were plenty of others that had selective sweeps…
If there were truly “selective sweeps,” then those cases also don’t map cleanly to the Mk3 flaw. The randomness bug doesn’t give an attacker partial access. it gives them the full seed. Once the seed is weak, every UTXO derived from it is equally exposed.
Selective movement means something else was different between those UTXOs: a separate backup path, a reused seed, a partially‑exposed key, or an external leak. The Mk3 flaw is deterministic. Selective behavior isn’t.
Thanks!
I don’t know….
I was pretty careful with never reusing addresses and keeping the device completely airgapped.
Could it be possible that they got my key because this mk3 was a 1 of 3 in a multi sig setup and the utxo that got drained was change from a utxo that was recently moved from the multi sig vault? Their script didn’t pick up the unrelated utxos that were still left in the wallet?
Honestly fuck hackers. The fact we have to worry about this shit and protect ourselves against pieces of shit that steal for a living is an indictment on humanity
The selective sweep was a bug/lazy implementation on the part of the attacker’s LLM.
If the attacker’s script was sloppy, that still doesn’t make it the Mk3 flaw. The Mk3 bug gives full access to the whole seed, meaning all UTXOs are equally exposed.
If only some UTXOs moved, that means the attacker didn’t have full seed access. That’s why selective sweeps don’t line up with the Mk3 randomness issue.
Coulndt you just see if you are compromised by looking at the structure of the private key itself?
I'd not trust a passphrase for long on its own. It will buy time, but use some of that to upgrade
You should generate your own keys. Not your entropy, not your keys.
I can't thank myself enough for getting started. Despite the economic situation, I'm so happy to see €78,000 in returns from a €15,000 short-term investment with pjtradinghub. His videos are top-notch and highly educational, giving you real insights to achieve your goals and come out from debt! For a guide to a professional trader, I highly recommend everyone check out his Telegram 👉 "pjtradinghub"
This is what I don’t understand. I wouldn’t sleep well knowing that all a burglar needed was my seed to get to my savings. A passphrase has always been basic opsec.
Thank God you have nfc capabilities!
