Self Custody Is Dead. Long Live Self Custody
Bitcoin Magazine
Self Custody Is Dead. Long Live Self Custody
The Coldcard hack last week dealt a low blow to certain elements of the Bitcoin industry. A somber introspection has begun to question many of the practices and assumptions involved in securing bitcoin at a retail level. The consequences of this process might not be visible for many months.
Some are saying that self-custody is dead. Some reports estimate that over 11,000 bitcoins were moved to custodial exchanges last week as users fled one of the most popular hardware wallets in the Bitcoin industry. The hack, which is ongoing and users can still save themselves from, has seen north of 1,300 bitcoins stolen, with some estimates as high as 2,000 coins.
Coinkite in particular and its most vocal founder, NVK, had very strong opinions about what it took to secure bitcoin private keys from hackers. Its hardware wallets were airgapped to make sure malware could not exfiltrate data through USB cables. It used low-resolution, LED screens to avoid the complexity of touch screens. It developed protocols like BBQR and integrated NFC so that information could be transferred between the device and a computer without them touching or sharing SD cards. The list of paranoid design choices that made Coldcards iconic is long.
Yet the hackers involved in the theft of bitcoins held in Coldcards last week did not use any methods you might see in a modern spy movie. They exploited the one feature Coldcard should have had absolutely locked down. The generation of keys with high enough randomness, also known as entropy. In other words, secrets securing that are actually, mathematically hard to guess. While the devices were intended to use high-quality sources of entropy, the firmware had a bug which did not, resulting in Bitcoin private keys that were, in turn, easy to guess. The bug went undiscovered for years, and the product only grew in popularity in the meantime, until last week.
… Continue reading the full article at the original source below.
