COLDCARD SECURITY RISK: IMMEDIATE ACTION REQUIRED

Bitcoin Magazine

COLDCARD SECURITY RISK: IMMEDIATE ACTION REQUIRED

First, yes, that is a very clickbait title and completely unusual. This is a real security issue. Here is the official announcement from Coinkite themselves posted yesterday, please read and verify the genuineness of the issue there.

TLDR: Coldcard MK3, MK4, MK5 and Q are being drained. A bug lets attackers find your seed phrase without any action on your part. Only wallets generated using the dice roll method are safe, assuming you rolled at least 50 dice. If you don’t know, don’t remember, or aren’t sure, move your funds immediately.

This is a critical issue that requires immediate action. If you used a Coldcard to generate a word seed and did NOT use the recommended 50+ dice rolls to provide your own entropy after the end of 2020, your word seed is not secure. It was generated without a sufficient amount of randomness, and can be brute forced by a malicious attacker. Wallets are actively being drained now. This issue also affects any ephemeral keys and session keys for Clone Coldcard or Key Teleport features, and BIP 85 seeds generated from a compromised seed. YOU MUST STILL MOVE YOUR FUNDS.

… Continue reading the full article at the original source below.