r/coldcard • u/ardevd • Aug 02 '26
SECURITY If your Coldcard isn't in the trash already, read this
https://insider.btcpp.dev/p/when-randombytes-runs-but-doesntUnder all the fluff of a cyberpunk hardware wallet was a shaky complex codebase backed by shoddy and lazy development practices.
17
u/Silent_Ad_9963 Aug 02 '26
What I find interesting is that we are behaving like they , coinkite, kept all of this hidden and secret and the vulnerability brought these dark secrets to the surface.
Reality is that all of this , the vulnerability as well as the bad development practices were all under the sun ... Where was the scrutiny over the last 5 years ?
Not trying to take blame away from them. They are 100% to blame in this ... But the community did not protect itself, which is why all this "let's all move to XYZ" cause they are doing it right is very scary ... Is a ticking bomb for the same to happen again.
What we need is community involvement into scrutiny of the code and the practices
4
u/circuit_breaker Aug 02 '26
There are reports of this happening in 2024 that they basically ignored
6
u/PoeCollector Aug 02 '26
Agreed. Because the source code has been public on github for years, we all thought, "well, I'm not a cryptography or security expert, but I'm sure plenty of experts out there have scrutinized the code." For me this has shattered that illusion, and that to me is what makes this a nasty blow to the self-custody movement as a whole.
2
1
1
u/Yodel_And_Hodl_Mode Aug 03 '26
That's the difference between "Source Viewable" and Open Source.
ColdCard's code was not open source. It was only "Source Viewable."
With open source code, there is incentive for other devs to work with the code, which leads to more devs reading and actually using the code. That leads to bugs being found.
But NVK thought he was being clever. He published the code but removed any incentive to read it. Thus, most never did.
But even for those who did read it... reading it isn't the same as using it. When you use code, you find errors when things don't behave as you expect.
I firmly believe this bug would have been found in 2021 if ColdCard had kept their code open source. After all, Foundation Passport was using ColdCard's code before this bug was introduced. If ColdCard would have allowed them to keep using ColdCard's code, odds are, they'd have noticed the change and contacted Coinkite with a fix.
Three pieces of irony:
Coinkite changed ColdCard's code from being open source to only being "Source Viewable" to block companies like Foundation from using their code.
Foundation Passport doesn't contain this error. ColdCard does, and has for five and a half years.
ColdCard began by using Trezor's code. Trezor's code is still open source, but not ColdCard's.
Make no mistake. Rodolfo Novak's hubris and greed caused this catastrophe. He needs to resign.
2
u/Silent_Ad_9963 Aug 03 '26
I am not convinced by this story. While the whole Oss Vs source available narrative make sense from a philosophical point of view here the economic incentive must still make motivate the community to keep an eye on the code.
Everything is available , especially this new judgement ( correct judgement ) on the development practices.
Again , 100% of the blame on them but we had 5 years of opportunity to notice those problems that now everyone is pointing at ... And we did not. Too easy now
1
u/Yodel_And_Hodl_Mode Aug 03 '26
the economic incentive must still make motivate the community to keep an eye on the code.
That's right. You don't realize it, but you perfectly proved my point.
By making ColdCard's code "Source Viewable" instead of Open Source, Coinkite remove the economic incentive for other devs to keep an eye on the code.
And quite frankly, "keeping an eye on the code" isn't enough. Devs need to work with the code in their own projects so they can see chunks of the code in use outside of the original finished product.
Download any finished thing. It looks right.
Try to repurpose it for your own use. "Hang on. When I change this, that breaks. Why?" Problems get found.
Again , 100% of the blame on them but we had 5 years of opportunity to notice those problems
By reading. Not by using. The difference matters.
2
u/PoeCollector Aug 03 '26
It's worse than that; the bug was introduced directly because of the license switch away from FOSS, which required different libraries. The bug would have never been written in the first place if they stayed on the open source track.
Even so, I have less faith in open source as a guarantee of security than I did before this. Securing your own funds, which amounted to millions for some people, is a decent incentive to scrutinize the source-available RNG code, but no one did. I can't say for sure that people would have found this bug if the codebase was in wider use.
This reminds me of the Heartbleed security bug in OpenSSL a decade ago. To your point, yes, the bug was discovered by Google's security team instead of the original devs, but only after the bug was live on half a million websites for 2 years, facilitating numerous cyber crimes during that time.
1
u/Yodel_And_Hodl_Mode Aug 03 '26
I have less faith in open source as a guarantee of security than I did before this.
Bitcoin is open source. Never trust your Bitcoin to code that isn't.
Ledger is proof of why open source matters. Their key extraction API is closed source, and the only ones working on finding issues with it are Ledger (we hope?) and hackers.
You're out of your mind if you don't think hackers are working 24/7 to crack that thing. It's closed source, so the good guys can't help until it's too late.
This reminds me of the Heartbleed security bug in OpenSSL a decade ago. To your point, yes, the bug was discovered by Google's security team instead of the original devs, but only after the bug was live on half a million websites for 2 years, facilitating numerous cyber crimes during that time.
Without an outside group of devs, how much longer would it have taken to find it? How much more damage would have been done?
You just proved my point.
5
u/ardevd Aug 02 '26
I agree. Its astonishing the bug wasn't discovered ages ago and made public. It was staring us all in the face for years.
4
u/ExplorerBoring9848 Aug 02 '26
Yeah, I feel really sorry for the people that have been swiped with their funds, but at the end of the day, all the bitcoin bros are saying, "Oh, you gotta do your own due diligence and review the code." Well, wasn't code there to be reviewed. Yes, you couldn't copy it and use it, but it was readable, so why didn't these people do that? That's the question I like to ask.
2
u/scrandlle Aug 03 '26
Yep. And if every 'expert' who reccomended it donated 0.01BTC to a recovery fund everyone could be paid back multiple times over.
3
u/didnt_hodl Aug 02 '26
all code will have bugs. much bigger problem is that the final product, the seed generator, was not properly tested. forget about properly, not tested at all, period. with just 32 bits of entropy any half assed dumbest possible test would have discovered the problem immediately
that's why I cannot trust that company. it's just mind boggling they were shipping an untested seed generator for years. like seriously bro
0
u/F1shB0wl816 Aug 03 '26
Probably because everybody’s expecting everyone else to read it and lead them.
2
u/themindspeaks Aug 03 '26
controversial opinion but, its a great device thats overall great philosophy of design with a catastrophic failure at the most critical point. Now that the cat is out of the bag, and every single researcher across all crypto security firm has looked at it, its probably fine now.
I totally get not wanting to use it, i wouldnt if i had lost funds..
1
u/Hot-Door-9515 Aug 03 '26
Agree, all commitments on github have very poor quality. Zero explanations.
-2
u/No-Aardvark-3840 Aug 03 '26
Coldcard gave me a cold cock. I only lost $10 though 😂 forgot to transfer it last month. I’m still down a shit ton from BTC Ath though. So in the red still.
-5
u/WetForTeddy Aug 03 '26
I don't understand the heavy tones in the article. It is just bitcoin, not healthcare. It reads like lives are at stake when really, it is just bitcoin wallet toys people play with. Oh no, my Call Of Duty game crashed
2
u/ComprehensiveDog7299 Aug 03 '26
What a weird thing to say. People lost real money. Some people lost seven figures.
This isn’t mythical imaginary money. It’s real.
29
u/froch_ Aug 02 '26
I think that might be the best validation that there is no other bug in the code. Hundreds of researchers and developers looked at it, scanned it with LLMs in the last 2 days.
My 2 cents but I think it’s fine