Zero-Knowledge Goof

Public heads-up for GPU cloud / rental providers and Trust & Safety teams: There is a publicly disclosed hardware-wallet entropy issue that may lead to abuse of consumer GPU rentals — especially multi-GPU NVIDIA RTX 3090 / 4090 and similar CUDA cards — for offline BIP-39 seed recovery. References: • Coinkite advisory: blog.coinkite.com/coldcard-mk3-s… • Technical background: blog.coinkite.com/entropy-techni… • Live theft tracker: coldcard-watch.vercel.app What this looks like technically: • Offline search of a reduced BIP-39 seed space via bulk PBKDF2-HMAC-SHA512 (2048 iterations) • Mk3: does not need GPUs — that space is small enough to brute-force cheaply, and Mk3 seeds are already linked to on-chain thefts • Mk4 and later: does need large amounts of compute. Those seeds are stronger but still weaker than full design entropy for some pre-fix units. Rough ballpark: recovering one seed ≈ ~10× RTX 4090s for about a day • On rental platforms this tends to look like long-running custom CUDA/hashing binaries or containers on multi-GPU 30/40-series instances — not normal training/inference API usage Why this matters now: the low-hanging fruit (Mk3 and the weakest seeds that need little or no GPU) appears largely drained already — the tracker above shows the ongoing thefts. The next wave is Mk4-and-later seeds, which are compute-bound. Large blocks of rented consumer GPUs are the bottleneck for attackers. This is not a vulnerability report against any platform. It's context so abuse / trust teams can: 1. Route future reports on this topic correctly 2. Optionally watch for suspicious multi-GPU, long-running custom CUDA jobs 3. Have background if law enforcement or researchers get in touch cc: @vast_ai @runpod @clore_ai @TensorDock @SaladTech @akashnet @MassedCompute @Hyperstackcloud @fluidstack Happy to help any team dig in.

Qwen3-coder-next same prompt...FAIL (even after showing it the problem).

Kimi k3 same prompt...SUCCESS x.com/ozdeadman/stat…

Starting a thread of prompt attempts to see what what was exactly missing from nick's audit prompt for the good of science. Opus 5 xhigh same prompt...FAILED

Why is it not unique? Even if it isn’t it’s very unlikely for the attacker to have a CC with the same one isn’t it? You require a signed message also of course so it’s not just *anyone*. Videos of person with cold card showing the serial number id guess are still difficult to fake dozens of times without leaving a noticeable pattern. If no one else claims for 3 months you release it. If there is contention you require physical fedexing the device.

@LLFOURN @robin_linus @nvk @COLDCARDwallet The UID artefact isn't anywhere near unique, AND requires access to the device. You can't just say "first with these coordinates to claim, gets the coins"

Hey @nvk @COLDCARDwallet, do you have any information about the UIDs that could help white hats search the space faster than attackers?

@KLoaec @robin_linus @nvk @COLDCARDwallet I think many victims would strongly disagree. There is a high chance of valid claiming because of the UID artifact .

For the record, I am absolutely against stealing from users who still can move their coins now, and may never be able to claim them once you steal them. I find this behavior disgusting, when you know it's very unlikely to be able to give it back. Many users don't even have their original device anymore.

I would have: 1. ran the attack and got all the seedwords to determine scope 2. asked coinkite what would be the best way to authenticate the affected users. 3. Move all the coins with an OP_RETURN with a link to a website explaining what has happened 4. Make a return process which filters out most of the scammers

As an honest person discovering the ColdCard bug, what would you do? 1. Say & do nothing, hoping no one dishonest ever discovers it too 2. Disclose privately to CoinKite, who've no means of privately contacting affected individuals 3. Grab all the coins for later return 4. Other

I have spent over $10,000 scanning 100+ bitcoin ecosystem related libraries looking for vulnerabilities with Kimi K3 running as quarterback. Myself and a small "Red Team" have found multiple serious vulnerabilities impacting the ecosystem. They vary in scope severity, but this is a call to action. For any critical tier vulnerability that was identified if I was able to immediately demonstrate a POC (proof of concept), I have already responsibly disclosed to the maintainers. HERE IS HOW YOU CAN HELP ME IF YOU ARE NOT TECHNICAL: - please share with me any repository that is on github that I can scan, we want to cast a wide net. It takes a few moments for you to link github accounts, we'll take it from there - if that project does not have a SECURITY.md make an issue asking the dev to list one IF YOU ARE TECHNICAL: - If you are a maintainer or contributor to a project, I may have already scanned your repo, hit me up I'll share the results, if not I'll add your project to the list. - If I can trust you to do larger review to start looking through this stuff to give me more eyes let me know. AI Has forever changed software development. Tomorrow marks 1 week of Kimi k3 being live in open weights. We are going to accelerate.

Already did one migration. Anyone else in Adelaide or surrounds need help getting off Coldcard?

@ozdeadman @rot13maxi legend thanks!

@LLFOURN @rot13maxi @LLFOURN @rot13maxi I ran it through Kimi K3

feel free to post it for me! Exact prompt is: I need to audit this firmware. In particular: -- Memory crashes / OOB -- Weak RNG source -- Nonce reuse -- Bitcoin transaction signing logic (e.g. oversized fee that doesn't get noticed) -- Number overflows -- Anything else that could lead to loss of funds or otherwise

@LLFOURN This is good. Try kimi k3 too

@theinstagibbs You can take someone seed words without bypassing their pin though. darkskippy.com

@LLFOURN ok but my tweet is actually helpful :P

Devil's advocate: A proper Secure Element means physical attack of chip isn't $100 and an afternoon but a week at an advanced lab at best for the attacker

Airgapping is a larp, secure elements are just PIN authenticators, and extra dice rolls are a prayer

So it turns out that at least one good guy was looking at problems in coldcard entropy before the attack. @utxoclub ran a prompt on 17th June but it failed to surface the issue for two main reasons: 1. Anthropic “ai safety” clown show meant it could only be done with opus 4.8 instead of fable at that time. 2. The coldcard code base is a cluster fuck of git sub modules.

@jaypatel Where is the actual prompt?

Increasingly think there was no audit. Having frontier level OS models like Kimi K3 is a great thing to get ahead of these attacks, but this was not a complex exploit. It was just a case of no one looking. Here is Qwen 3.6 27b, a model that can run on a $1200 macbook and came out almost 4 months ago, finding the vulnerability with no guidance and a one sentence prompt.

@afilini @otaliptus All my analysis was just smooth brained prompts to grok.

@otaliptus @LLFOURN +1 if you have any links please share with us!

Attackers are buying the compute necessary and are ticking away at the mk4s, mk5s and Qs right now. The bit space is probably around 10-14 bits smaller than I estimate here. It could be less depending on the clock behaviour.

@ozsats256 @utxoclub @COLDCARDwallet It’s a good idea I’ll give a clean room prompt on the models I have tomorrow.

@utxoclub @COLDCARDwallet Has anyone found the bug with a frontier without biasing it? It’s almost as if a human had this occur to them in their sleep.

Seven weeks ago I pointed Opus 4.8 at the @COLDCARDwallet firmware and told it to find bugs that lose people money. The second bullet of my prompt: Weak RNG source.

Why did Opus miss? We hadn't cloned enough of Coldcard's submodules. This bug lives between files, and some of those files weren't on disk. What was present told a self consistent story, with convincing docstrings at the boundary: "best-quality high entropy TRNG bytes".