Cameron Otsuka

Bitcoin Wallets Emptied

In the Bitcoin world, it would be incorrect to think a Bitcoin wallet actually holds any Bitcoin. Despite the similar names, Bitcoin wallets carry out very different functions from the common cash wallet we carry around in our pockets. Bitcoin is technically “stored” on the public blockchain and a user can “unlock” that Bitcoin to send it somewhere using a private key. That private key is what is actually being stored in a Bitcoin wallet.

Across Bitcoin’s history, there have generally been two types of wallets: hot and cold. Hot wallets are accessible directly from a computer: often more convenient for users to spend from or to integrate with other services, but with the potential downside of making it easier to be stolen through malicious means.

Cold wallets, in comparison, are air-gapped and often purport to have additional physical security improvements like protection against certain side-channel attacks and duress codes. What is often not discussed very often is how that private key is generated, because whether the private key is stored on a cold or hot wallet, if the key is easily guessable, it doesn’t matter how it is protected.

For those who want to learn the actual mechanics of how elliptic curve cryptography works, I invite you to start at its Wikipedia page. The high-level (aka incorrect) version is that there is a curve, upon which a random point is selected, a tangent line is drawn until it intersects with the curve, it is flipped along the axis, a new line is drawn between the points, it is flipped along the axis again, and so on.

This makes it very easy to conduct the correct calculations if you know what the original point was. If you don’t know what the point was, it is extremely computationally expensive to ever correctly guess the original point.

So applying this back to Bitcoin private keys, done correctly, it would be effectively impossible for someone to guess the correct private key for a given Bitcoin, unless they had it to begin with. Of course, I bolded the word “random” in the paragraph above, because all of the fancy math depends upon truly random inputs. If a Bitcoin private key is generated with less than full randomness, it could be possible for an attacker to exploit this weakness to attempt to guess the private key.

This is exactly what happened over the weekend to users of Coinkite’s Coldcard hardware wallets. From Block:

An attacker who can determine or sufficiently constrain the device UID, timer state and RNG-call history can reproduce the fallback stream offline.

A wallet xpub, address or generated public key provides a candidate-validation oracle. Successful recovery of a wallet seed or private key permits theft of all associated funds.

For Mk2/Mk3 v4, there is no cryptographically generated secret input to enumerate. For current devices, once the fallback state and call history are fixed, the remaining secure-element-derived search space is at most 2^32, averaging approximately 2^31 candidate trials.

This does not mean every remote attacker can immediately recover every seed. Practical cost depends on available UID information, boot timing, prior RNG calls and derivation cost. No end-to-end brute-force benchmark is claimed here.

Galaxy Research’s latest update (as of this article) have identified a confirmed 1,367 BTC stolen, with up to 2,055 BTC potentially attributed to the same exploit.

A truly terrible result for Coldcard users who trusted the entropy generated by their device to provide them with a private key that would protect their Bitcoin. The bug and its exploitation has already led to introspection across the ecosystem, with the formation of ad hoc red teams analyzing codebases for vulnerabilities, and commentary on whether Anthropic’s/OpenAI’s overzealous safeguards place defenders at a disadvantage.

Mine Print Hash

Recording while I was on the road, Matt Dines and I go over the Fed’s decision to maintain rates and some early warning signs in the dissents, a pilot project with three major Chinese banks to issue DR-linked loans which may signal a future interconnection with the broader dollar system, and what Lockheed Martin’s Patriot missile contract tells us about the US’ outlook on future kinetic conflicts.

Open Threads

US interventions:

• US Treasury intervenes in Yen market. Link
• US in talks with Oman to open routes through Hormuz. Link

Cybersecurity can’t keep up with the attacks:

• Shai-Hulud is back. Link
• OpenAI’s model breaking out of its sandbox is likely just the beginning. Link