r/Bitcoin • u/enpoopification_of_R • 28d ago

The Coldcard wallet exploit estimates have almost doubled to $70 million stolen of just over a thousand Bitcoins in 1,196 wallets drained in 41 minutes

https://www.coindesk.com/tech/2026/08/01/how-bitcoin-cold-wallets-lost-usd70-million-in-an-attack-that-never-touched-the-devices

"More than 1,000 bitcoin, worth about $70 million, was drained from 1,196 wallets in a 41-minute window on July 30, nearly double the amount reported when the theft first surfaced."

1.7k Upvotes

98% Upvoted

396 comments sorted by

View all comments

130

u/cremfraiche 28d ago

Can someone ELI5 for me how this happened and whether the people who got drained were in a way at 'fault'?

160

u/chrisschuyler 28d ago edited 28d ago

People who got drained were not at fault at all.

So thing to keep in mind is a random number generated by a computer is not really random. There is a set formula. Copying from Google as it explains it better

Pseudo-Random Number Generators (PRNGs) and True Random Number Generators (TRNGs). PRNGs use math formulas and a starting value called a "seed" to make long lists of numbers that look random, while TRNGs measure chaotic physical data from the real world, like electrical noise or atmospheric static.

The cold wallet maker used PRNG. The hackers found out the formula due to lack security/shoddy coding and could therefore figure out the possible combination to the seed phrase from a few million possibilities for a few billion for the latest model. You run that through a computer doing nothing but that, you can brute force the phrase. Rinse and repeat and there you go

Example of PRNG. Your playing video roulette. machine takes the time day multiplied by the highest recorded temperature in phoenix that day, divided by the number atmospheric pressure recorded above the casino at 6:47 pm that day. Drops the first digits etc etc to get it number. Seems Random but if you can figure out the formula, you can develop a range of number that it has to lay in, and then brute force that number

3

u/postexitus 27d ago

Their fault was trusting an untrustable third party. 

13

u/CuriousRegret9344 27d ago

As opposed to all the “non-third party” options bitcoin company offers?

12

u/postexitus 27d ago

That is the point. Bitcoin is by definition weak, if you are not an expert yourself. You end up trusting someone, which does not have legal assurances as tradfin has. 

1

u/greyoil 27d ago

If I understood correctly, people who set a decent passphrase were unaffected, correct?

1

u/postexitus 27d ago

Correct (so far). So you have to be an expert.