Urgent Warning for ColdCard Users, with Rob Hamilton

— ColdCard hardware wallet compromise: MK3, MK4, MK5, and ColdCard Q models are affected. MK3 (2021–2023) poses the highest risk; later models have reduced but still significant vulnerability. Attackers can reverse-engineer seed phrases without physical access to the device.

— Root cause — insufficient entropy: A single line of code in ColdCard's seed phrase generation reduced the randomness from a full deck of possibilities to only 20 cards' worth. This allows attackers to brute-force guess all combinations in hours rather than the age of the universe.

— AI-assisted exploit: An open-weight LLM (KimiK3, released Monday) with fewer safety guardrails than OpenAI or Anthropic models identified and exploited the bug within minutes. Closed-weight models (GPT, Claude) refused similar queries.

— Scope of theft: Over 1,000 BTC confirmed stolen across multiple attackers (not a single threat actor). More Bitcoin moving every hour. Additional funds at risk include those migrated to other devices but originally generated on ColdCard, and multi-sig setups using two or more ColdCard signers.

— Immediate action required: Move funds urgently to a safe location (exchange, different hardware, or multi-sig with non-ColdCard devices). Run test transactions before moving full amounts. If you added a password or rolled custom dice entropy during setup, your risk is reduced but not eliminated.

— Privacy trade-off: ColdCard's no-customer-data policy prevents direct user notification but necessitates public PSA campaigns to reach affected users.

— If you own any ColdCard (MK3, MK4, MK5, or Q): Immediately move funds to a trusted exchange (River, Swan, Strike) or a multi-sig setup using non-ColdCard hardware. Use test transactions first to verify the receiving address. Do not delay this over the weekend.

— Multi-sig users: Verify your setup. If any two of your three signers are ColdCard devices, you are at risk even with multi-sig protection. Rebalance to include non-ColdCard hardware (Ledger, Jade, or others that passed independent post-incident security reviews).

— Future seed phrase generation: When creating new wallets, either add a passphrase on top of your seed, roll custom dice to introduce your own entropy, or use hardware from vendors that have publicly confirmed independent security audits post-ColdCard incident.