Jonathan Goodman: Losing $1.6 Million in ColdCard Hack, Why He Isn't Angry and the Bigger Lesson Learned

**Jonathan Goodman** (0:00)
I just had a million dollars plus stolen in Bitcoin. I don't have any Bitcoin left. What happened was I saw a post, emergency, emergency, there's been a hack. If you have a Coldcard device, check your funds, move them now. I knew at that moment that I was screwed. This was savings that was put away for my children. To be robbed is one thing, to be robbed for that amount of money.

**Natalie Brunell** (0:19)
Are you angry?

**Jonathan Goodman** (0:20)
What's the point? What good is that gonna do? Call it a crucible. I'm choosing to view it as a test, as to say, prove yourself.

**Natalie Brunell** (0:26)
If you were sitting across from NBK, what would you say to him?
Hey everyone, welcome back to the show. Joining me this week is Jonathan Goodman. He is one of the victims of the Coldcard hack. He lost more than 18 Bitcoin. And Jonathan, I can't imagine what you went through that week that we all found out that there was this vulnerability that none of us expected. You did everything right. You had your Bitcoin and cold storage. And there was an error with the device such that your seed phrase could be guessed. I mean, that's so crazy to me still. But take me back to what exactly happened. Because essentially, you must have opened up your computer and realized everything's drained.

**Jonathan Goodman** (1:13)
Yeah. Yeah. We were at our cottage just outside of Toronto. And the internet went out. So we went to the library to work. Right. And we drove to the library and I went upstairs, opened up my computer to work and my wife and our three kids were downstairs checking out books. And I opened up my computer and instead of starting work, I opened up Facebook. And I saw a post from my friend Brad, who's a Bitcoin guy, who said, emergency, emergency, there's been a hack. If you have a cold card device, check your funds, move them now, message me, I'll help you, et cetera, et cetera, et cetera.
The first thing that went through my mind is, there's no way that this affects me. I mean, you see people post about hacks every single day on the internet. There's no way that this affects me. But I knew that I used cold card devices. I had three of them. I knew that. But again, I was like, there's no way this affects me. These three devices I bought in 2021
I put them in a safety deposit box at the bank. I have opened up that safety deposit box once since 2021
Anyway, I was like, I'll check. May as well. I put on my VPN and I opened up my Wasabi wallet. It took a few minutes for the data to download because I never open up Wasabi, because I never check because I was always a long-term investor. I never traded Bitcoin. It was, I believe in the fundamental theory, it didn't matter what the price was on any given day. It was just like, I'm going to invest in it. And yeah, Wasabi downloaded and the first of the three wallets opened and I saw a red line.
And it was, I knew at that moment that I was screwed.

**Natalie Brunell** (3:06)
So you had three devices all single SIG?

**Jonathan Goodman** (3:10)
I now know what that term means, yes.

**Natalie Brunell** (3:12)
So you didn't know what single SIG meant before? It was kind of like, okay, I'm going to get this device. I'm going to generate a seed phrase. I'm going to keep those in a safe place. And that was the most that you kind of thought about it. Like take me back to when you even decided to use Coldcard and put your keys in self custody.

**Jonathan Goodman** (3:30)
I mean, I thought I was going to be as careful as possible. I protected against everything, right? I bought the device that all the Bitcoiners said was the most secure device. I a-gapped it when I did the transaction.
I kept the devices in a safety deposit box. And then as my backup, I had, I metal stamped my seed phrase onto it. That is, and I had three devices, so I had it split across three devices. That's five different redundancies to protect. I now know, because there's been so many articles written about this and about my participation specifically just because of the post that I wrote that went viral, I now know what my error was. Engineers call it common cause failure.
Every piece of protection that I had was protecting against the same vulnerability. It wasn't protecting against my time. But how could anyone know? That's the interesting question, isn't it?