The Coldcard Disaster: Everything You Need to Know | Lloyd Fournier & Nick Farrow

**Nick Farrow** (0:02)
The Bitcoiners, these are people all in on Bitcoin. You know, they're people with families, like they're saving all their money in Bitcoin, and they're doing all the right things. They're self-custodying it, and then overnight, it's just gone.

**Lloyd Fournier** (0:14)
Like it is really sad because I look at the chart. I can see when people are buying Mark 3s with this corrupted form of firmware, you can see the money starting to go into the insecure wallets. The money keeps going up in the Mark 3s, because people are still stacking. They're doing what they've been told to stack sats, and they more than double the amount of Bitcoin in their compromised Mark 3s. So that bit is very sad. Years spent stacking on thing and it's gone.

**Danny Knowles** (0:40)
Like this has hit a lot of people. Do we know how much Bitcoin is as of right now?

**Lloyd Fournier** (0:44)
1,200-ish people and almost 2,000 Bitcoin. Criminals who are focused just on this, their skills are there. They know what they're doing now, and they know how to target and they get information and they know how to do it.

**Danny Knowles** (0:58)
Frostsnap team, let's go. How are you doing, guys?

**Nick Farrow** (1:00)
Very good, Danny, thanks for having us here in Sydney.

**Danny Knowles** (1:04)
I don't know where, in fact, the first place to start, I think, is if anyone out there has not heard about this Coldcard vulnerability somehow, probably time to turn off the show, move your Bitcoin off a Coldcard. I did a video with Rob Hamilton as soon as this dropped. I'll put a link in the description. Go watch that and do something about it immediately, because we're going to get into the details here.
But let's start with like, when did you first hear about this? Lloyd, let's start with you.

**Lloyd Fournier** (1:30)
It was in the morning, it was just before a meeting or whatever, and it was good because I was going to about to make a point about our feature of Frostsnap, which means we don't have to rely on the device entropy. I guess linked in the group chat and I said, yeah, there's something wrong with the Coldcard. I thought someone made some fake Coldcards or something and give them out, didn't really know what it was, and then after the meeting, it was in full swing. It was a complete nightmare and I was transfixed by it.

**Danny Knowles** (1:54)
Yeah, luckily, I am almost always on Bitcoin Twitter, so I think I saw it quite early and the first thing I thought was like, this is probably FUD. I imagined that it was being over exaggerated, text Rob Hamilton right away being like, is this real? And he was like... Because I had some funds on a mark four, luckily, but I'd like generate the keys on the device, so it's still vulnerable to a degree.
And he was like, move them immediately, don't mess around, this is not a drill. And I was not with the wallet, so I had to do a phone call, managed to get the Bitcoin moved. But like scary times. And I don't think we've still digested everything that's happened as like a Bitcoin industry yet.

**Nick Farrow** (2:33)
I don't think so at all. I think people are sort of grieving in a bunch of different ways without actually sort of having to had time to soak it all in. But one thing I was surprised at was how quick the response was actually from some of the big names like Kevin from Liana and I think it was Instagibs, I think he's a Bitcoin Core developer. I think it could be wrong there.
They wanted this right away and sort of raising the alarm, which is quite a risky thing to do as well. You don't want to be the person who raised the alarm and then be wrong and then sort of, but I think Instagibs found some proof that once he'd seen what he'd seen, he was ready to pull the trigger and say that something's really messed up here.

**Danny Knowles** (3:13)
Yeah, the thing that sort of surprised me with it is, it looks like this was found by an AI model, but this is viewable code. I know it's not fully open source code, but it's viewable code. And I know people like you actually look through this code.

**Lloyd Fournier** (3:27)
Nick was the one looking through it.

**Nick Farrow** (3:28)
Oh, really?

**Danny Knowles** (3:29)
But like, why was this overlooked or not found earlier?

**Lloyd Fournier** (3:34)
I have my theory about it and I have to put my own hat on because I didn't look at the code, and neither did Nick, to be fair. Like, this part of the code, Nick didn't look at it. He did point AIs at it and why didn't the AIs and the humans? Everyone failed. And not only that, but like all the different things failed, you know? Like all the safeguards that this kind of thing wouldn't happen. They had several checks in there to make sure this kind of thing wouldn't happen. Tests of the RNG, all the kind of things. Those all failed. And then all the extra randomnesses also failed, basically. And so like there's just failure after failure, so it feels like you're on a different timeline. Like it's cursed, basically, this kind of outcome. So why, but in reality, like it wasn't just bad luck. There was some contributing factors. So what I think is that the code was actually quite bad, okay? So not just this problem, but the code around it was actually very bad. And I was surprised because I thought Coldcard, if you're looking at how this generates randomness, the code will just be pristine, you know what I mean? It's like, I'm gonna spend 10 hours doing this. Every line of code will be perfect and just make total sense to everyone who's reading it. And then as I'm looking at it, and it's like red flags everywhere, smoke and fire everywhere. And like, no wonder people have been emailing them about it, doing security disclosures without ever getting actually at the thing that caused the problem, but just pointing out like, man, what are you doing with this randomness? Okay, you get randomness from here, but then you put this YASMIRANG RNG thing, which is now like a famous meme RNG, because it's not a cryptographic RNG.