Sign inOpen the app
Unchained

Is Any Cold Wallet Safe? Inside the Coldcard Hack's Wave Three

Yesterday · 18 min
0:00-18:39

Streams straight from the publisher. podnod never proxies or re-hosts episode audio.

Open in podnod

📢 Bits + Bips has its own channel now — full episodes here: https://www.youtube.com/@Bitsandbips 


A firmware bug quietly introduced into Coldcard hardware wallets in 2021 has let attackers drain an estimated 1,600 to 2,000 bitcoin, over $100 million, from cold storage addresses that sat untouched for years.

Galaxy Digital's Alex Thorn has been tracing the exploit in real time, and in this clip he breaks down exactly how the random number generator meant to secure private keys "failed silently" into "way too weak entropy," and lays out the wave-by-wave forensic trail he is using to track the attacker.

Alex Thorn identifies three confirmed attack waves and a possible fourth, and Chris Perkins makes the case that even a "trustless, permissionless" system still requires trusting something, in this case, a hardware wallet's own firmware.


Hosts:

  • Austin Campbell - Host of Bits + Bips, Founder of Zero Knowledge Group, and Adjunct Professor at NYU Stern

  • Ram Ahluwalia - Co-host of Bits + Bips and CEO of Lumida

  • Chris Perkins - Co-host of Bits + Bips and Head of Franklin Crypto

Guest:

  • Alex Thorn - Head of Research at Galaxy Digital and host of Galaxy Brains

This clip is from a longer conversation on the Coldcard hack, U.S. AI guardrails, and the case for self custody. Full episode here. https://youtu.be/0oYZGw2DSj0?si=TwubhLQ35L8cXyG_ 

We go live every Monday at 4:30pm ET. Subscribe to catch it live.


👉 Cape: Your biggest crypto vulnerability isn't your wallet, it's your phone number. Cape is America's privacy-first mobile carrier that rotates your SIM identity daily and blocks SIM swaps before they happen. Get 33% off your first six months at https://cape.co/unchained (use code: UNCHAINED).


Chapters

🔐 00:00 Coldcard's reputation as Bitcoin's gold standard hides a deep systemic flaw

🎲 03:42 How a 2021 firmware update let key generation fail silently into weak entropy

🕵️ 09:56 Alex Thorn traces three confirmed attack waves, and a possible fourth

🤝 14:05 'They trusted Coldcard to do the right thing': what broke when a hardware wallet failed

Learn more about your ad choices. Visit megaphone.fm/adchoices