#780: Dissecting The Coldcard Hack with Alex Thorn

**Marty Bent** (0:07)
You've had a dynamic where money's become freer than free. When you talk about a Fed just gone nuts, all the central banks going nuts.

**Alex Thorn** (0:16)
So it's all acting like safe haven.

**Marty Bent** (0:18)
I believe that in a world where central bankers are tripping over themselves to devalue their currency, Bitcoin wins. In the world of fiat currencies, Bitcoin is the victor.
I mean, that's part of the bold case for Bitcoin. If you're not paying attention, you probably should be. Probably should be.

**Alex Thorn** (0:35)
Probably should be.

**Marty Bent** (0:36)
Alex, the vibe has shifted from the last time we saw each other, which was a Thursday at the Galaxy event in DC.

**Alex Thorn** (0:44)
Yeah, it was just shifting. I think you came maybe an hour before that PubKey event started and said there might be some issue with cold card.
In my head, I was like, oh no, but I was hosting that event, so I got all tied up and I didn't realize that I didn't really see the rest of the night until, and then the next day I listened to your episode with James OB. Where you said that you had to be in a corner on the phone the whole time, which I, of course, now totally understand.

**Marty Bent** (1:18)
Yeah.
It's been a shitty week, but I wanted to get you on because you and the team, at Galaxy, have done an incredible job of tracking the attackers. It looks like there's multiple waves of attacks of people brute forcing private keys of those that were generated on cold card devices and contacting victims. And I think the knowledge you guys have gathered, the information that you've gathered over the last five days is important for people to understand what's going on. So I have the chart here. Maybe we start there.

**Alex Thorn** (1:56)
Sure.

**Marty Bent** (1:56)
Just what you guys have found based off of the information, the outreach they've gotten from victims. And I think you said so far, 94 have reached out to you.

**Alex Thorn** (2:05)
Yeah. It's in the mid-90s. I mean, it's growing, I mean, all the time. I mean, especially as I did Nick Batia's show yesterday, I did Unchained yesterday where, of course, I called for victims to not be ashamed. You did nothing wrong. You did not deserve this. Share.
First of all, file police report. Well, first of all, secure. You haven't secured your funds on a potentially vulnerable cold card. Please do that immediately. But also share your drained addresses and the transaction IDs that drain them. I know, you know, it's hard for people to do it, but because I've been saying that, people have been sharing. And it's because of that sharing that we've been able to identify so many of the coins and where they are, what addresses they're sitting in. So, you know, it's also an end sort of an exchange, although I don't think of it. In fact, initially, I wasn't even doing it this way, but I can fulsomely trace anything in Bitcoin.
I have a very powerful proprietary Bitcoin stack with some clankers sitting on top of it that helped me traverse. So I've been providing back like forensic reports to victims that they can then use to report to their local authorities, to the FBI, and that we can use as well to report to crypto exchanges and chain analysis and all that so that there's a chance that the funds get frozen. But please do continue to reach out and share those addresses with me so that we can keep building up the picture of the attack as it unfolds.

**Marty Bent** (3:45)
And let's dive into the nature of these attacks. Obviously, it started late Thursday afternoon, early Thursday night. And I think it's become clear that AI was used to identify this vulnerability and then exploit it. And you can see that in the patterns of the waves of drainings that we've seen in the first wave. It seems apparent that the person who started draining the wallets of cold card users didn't really understand best practices or how to actually scope through a wallet. There was a very specific pattern to this first wave, correct?

**Alex Thorn** (4:26)
Yeah. So this pattern, I think they were the first. They're certainly where I learned of the pattern, which was the engineers at Block, Inc.
Obviously, the guys behind Cash App, a key, Spiral, etc., Square, right? They identified this pattern as a pattern, right? A key piece of the pattern was a fixed 30-sat per V-byte fee on all draining transactions. That was substantially higher than the median fee rate at the time, which being higher than the median is not in itself that surprising, right? Attackers are willing to overspend to make sure they get the funds.