Urgent Warning for ColdCard Users, with Rob Hamilton

**Natalie Brunell** (0:00)
Hey everyone, this is an urgent episode that we are recording in relation to what's happening with ColdCard. So here with me is Rob Hamilton. He is the co-founder and CEO of AnchorWatch. He's been following this extremely closely, and he's gonna help break it down for all of us non-technical folks. So Rob, thank you for joining me. Let's just get right into it. What happened here?

**Rob Hamilton** (0:22)
Yes, so it was yesterday morning, there was some suspicious activity of Bitcoin moving across the network. Very quickly, the initial reports were coming from people who used a ColdCard and had never connected it to the Internet.
That was where the investigation began across many people within the industry to find out if there was something wrong. Ultimately, it was found out in the ColdCard MK3 version, and onward, there are issues with how the device secures your Bitcoin, ultimately. This is something that even if you never had it on the Internet, the nature of this bug is such that someone remotely who's never met you, who's never touched your hardware wallet, who's never even looked at it, is able to possibly reverse engineer your Bitcoin.

**Natalie Brunell** (1:20)
OK, so let's just break it down and zoom out a little bit. ColdCard is a hardware wallet. It is cold storage. It's been known as among the gold standard of these wallets.
I have used it and so I had to move funds yesterday. I just want everyone to know that. A lot of us, we followed what we thought were the proper protocols and you could still be at risk. So this doesn't just impact one model, right? Can you make it clear exactly how many models there are and who could be at risk with their funds? Because this is active and ongoing.

**Rob Hamilton** (1:50)
This is active and ongoing. Every hour more Bitcoin are moving. So the time is of the essence. If you have what is called the MK3 model, it came out in 2021 through 2023
Your priority is to move that as soon as possible if the funds have not already moved.
The MK4 and MK5 are the later models. They have an issue related to this, but it is not as severe. If you have an MK4 or MK5 ColdCard, I would urge you as soon as possible to make a move because funds are moving every hour. There is more security but not sufficient security to keep it safe for long term. This is also for the ColdCard queue as well. It is in the same bucket of at the moment it may be safe, but I would urge urgently to move your funds.

**Natalie Brunell** (2:45)
When you start with one of these wallets, it generates a seed phrase. Can you maybe talk about what's behind that and what the breach was here?

**Rob Hamilton** (2:54)
Yeah. Maybe the best way to start is let's talk about a deck of cards.
A card deck is a really great way to play games because if you have 52 cards in a deck, every time you shuffle them, there are more possible ways you can arrange the cards in the deck of cards than there are atoms in the observable universe. There is just so many cards. Yeah.
This is really the beautiful part of cryptography when it works correctly, is that you can take very simple things and make abundantly complicated things and the job of a hardware wallet, and the job even just in the Bitcoin layer. The way Bitcoin works ultimately is I have a very large number that you will never be able to guess. That is the simplest way to break down how Bitcoin security works. Someone has a number and you are unable to do it. Another metaphor I like using is if, let's say if you've ever walked into a post office and you see that wall of post PO boxes, the PO boxes are kind of like your addresses.

**Natalie Brunell** (4:01)
You're public.

**Rob Hamilton** (4:02)
They're public. Anyone can send envelopes to them.
If you have the mail key though, you're the only one who can open up the mail key and take the letters out of the mailbox. The issue what we have here is that instead of dealing with say a full deck of cards, we are only dealing with 20 cards in the deck. And the thing is, 52, 20 still sounds like a large number, but it greatly reduces the possible number of ways you can arrange that deck of cards. And that allows you to basically, without ever talking to the hardware wallet, know that instead of looking at the universe of the full deck of cards, you're looking at a subset, and it allows you to aggressively, very quickly, guess all of the random combinations. If your Bitcoin is basically a needle in a cosmic level hay stack, what's happening here is someone found the exact area of the pile of hay and is just rapidly combing through every single strand to try and find where the Bitcoin sits.