The Safest Way to Store Bitcoin Was Just Hacked

[00:01] on the holdlers, last week what used to be the safest way to store Bitcoin turned out to be the fastest way to lose it when Cold Card, a securityobsessed airgapped Bitcoin hardware wallet, was hacked. The bad news is that a lot of

[00:13] people lost a lot of money. But the good news is that it's only about half as thing happened a year ago. Since July 30th, attackers have drained over 1,600 Bitcoin worth about $und00 million from over 7,000 wallets. And the craziest

[00:27] part is that they pulled it off without any malware, fishing, or lead pipes. The victims weren't your typical degenerates clicking random Discord links either. They were the responsible ones with the not your keys, not your crypto tattoos,

[00:39] actually deserve freedom if your coins were on an exchange. In today's video, we'll dive into how the hack works and learn why victims are now bidding to buy back their own money. It is August 5th, 2026, and you're watching

[00:54] your net worth drop 60% in a day, you may not know that the way Bitcoin works is that your coins are controlled by a private key, which comes from a 12-word seed phrase. If you have those words, you have the Bitcoin. And since the

[01:07] entire security model depends on those words being unguessable, they're chosen generator. A properly generated seed phrase has 128 bits of entropy, which second, the universe would end before you got close. And this principle is

[01:22] exactly why hardware wallets exist in the first place. To generate keys on a dedicated offline device with a special chip whose entire job is to harvest universe. And no device took this more seriously than Cold Card made by

[01:36] Canadian company Coite. It's airgapped, open- source, and marketed to people who make you get a license to make toast in your own damn toaster. But it doesn't number generator is if you never actually use it. And for the last 5

[01:51] years, without them knowing, the cold card never did. Here's how it happened. The cold card's firmware runs on micro Python, which ships its own basic random number generator, which was built for simple jobs, but it's nowhere strong

[02:03] knew this, so they wrote their own generator, and by setting a specific flag to zero, they disabled MicroPython's generator, or at least where things went wrong. But both number generators exposed a function with the

[02:17] exact same name and the crypto library would decide which one to use based on an if not defined check. And because the flag was technically defined just as a zero, the check passed and every seed phrase was generated by the basic

[02:29] MicroPython number generator, not cold card sophisticated generator. But it turns out because a bare metal chip has no operating system, there's nowhere for MicroPython's number generator to get real randomness from. So instead, it

[02:42] and a timer, both of which are deterministic. So instead of guessing a universe, you could just loop through all possible combinations of serial numbers and timer values and come away with everyone's keys. And on July 30th,

[02:57] under an hour, the first attacker drained over a,000 Bitcoin from nearly,200 addresses, hitting the biggest wallets first. Then two more attacks happened over the weekend which pushed the total to nearly 1,800 Bitcoin

[03:10] from over 7,000 addresses. A Coin Kite CEO apologized and took full attack, they couldn't just issue a firmware update to solve the problem. Because Bitcoin has no way to rotate a key, the only way out is for victims to

[03:24] coins with an actual onchain transaction. But of course, because this is Bitcoin, every transaction waits in the public memool until a minor includes it in a block, which means the attacker

[03:36] can just watch the memool for anything coming from a compromised address. They transaction with the same keys and a higher fee, and miners will confirm the highest bidder first. So when a fourth attack went live on Monday morning, the

[03:49] only way to win was to skip the public mem poolool entirely and send your rescue transaction directly to a mining pool. Since the bot can't outbid a transaction it never sees. So yeah, the official rescue plan for your trustless

[04:01] decentralized money was to put all your trust in one centralized minor and hope for the best. As for Quinkite, every unsold device in their warehouse carried halt shipments and take their remaining inventory out to the pasture. But all of

[04:15] just built their product with Lovable, the sponsor of today's video. Lately, better place. So, I use Lovable's AI development platform to build my own gamble away your life savings on things like future video topics or how many

[04:31] I started with plan mode where lovable mapped out the flow and let me edit the plan before writing any code. Then, it built the whole thing including O payments and a managed Postgress database on lovable cloud. It did get

[04:44] bug, but then I moved back into plan mode and lovable was able to fix it on its own. Then I gave the app its own MCP server is so that right here in Claude Code I can pull live odds or halt

[04:56] trading whenever I'm losing a bet to make sure the house always wins. Over 50 with lovable and you can try it out for free today with the link below. This has watching and I will see you in the next one.