COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

r/Bitcoin: first-hand account of a 5.13 BTC loss

reddit-5-13-btc-loss

https://www.reddit.com/r/Bitcoin/comments/1vemip7/your_keys_not_your_crypto_a_330k_lesson_for_all/

Latest reviewed change

source content difference between and

A new comment was added arguing that cryptocurrency is never truly possessed, that owners must be right every minute while attackers need only be right once.

seen +14 -0 full history below 
 body:
 What's odd is you believe in the white hats lol
 
+comment: p2jvmyu
+parent: t3_1vemip7
+author: 003E003
+created_utc: 1786232145
+edited: false

First lines only. The complete diff is in the timeline below.

Organisation
reddit
Evidence role
Community discussion
Published
not established
Source changes
17
Detected differences
17
Unreviewed
0
Copies held
18

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. source content difference between and Current source content +14 -0

    A new comment was added arguing that cryptocurrency is never truly possessed, that owners must be right every minute while attackers need only be right once.

    seen · Captured here 53,346 chars
    What changed from the previous capture 14 lines 
     body:
 What's odd is you believe in the white hats lol
 
+comment: p2jvmyu
+parent: t3_1vemip7
+author: 003E003
+created_utc: 1786232145
+edited: false
+body:
+It's never YOUR crypto. It's always on the chain. Not with you.  My cash in my safe is mine. My gold in my safe is mine. Your crypto is not the same.
+
+You don't just have to do the right things... You have to do the right things every minute of every day. They only have to be right once you have to be right all the time. 
+
+Every time you check your tokens, every time you click something, every time you move your tokens, every time you download a new app or connect to another service... You are risking them all. There are thousands of people who spend their whole day trying to take your tokens. They know more than you. You cannot possibly know all the different ways you are vulnerable. 
+
+They only need to beat you once.
+
 comment: p2k095a
 parent: t1_p2jigqo
 author: n8dahwgg
    Extracted text as captured 
    post: 1vemip7
author: Affectionate_Tea3401
created_utc: 1785783523
title: Your keys, not your crypto. A 330K lesson for all.
body:
I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe \~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

\- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff  
\- Last bull run started after the FTX crash, LFG!  
\- Nothing stops this train, whatever ever doesn't kill us makes us stronger  
\- Hardware wallets are a marketing scam  
\- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  2. source content difference between and source content +8 -0

    The thread gained a one-line comment asking for a TL;DR.

    seen · Captured here 52,520 chars
    What changed from the previous capture 8 lines 
     edited: false
 body:
 I mean, I know the guy so I know of at least one
+
+comment: p2l73jz
+parent: t3_1vemip7
+author: Flimsy-Flan5331
+created_utc: 1786249953
+edited: false
+body:
+TL;DR?
    Extracted text as captured 
    post: 1vemip7
author: Affectionate_Tea3401
created_utc: 1785783523
title: Your keys, not your crypto. A 330K lesson for all.
body:
I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe \~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

\- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff  
\- Last bull run started after the FTX crash, LFG!  
\- Nothing stops this train, whatever ever doesn't kill us makes us stronger  
\- Hardware wallets are a marketing scam  
\- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  3. source content difference between and source content +16 -0

    The thread gained two comments discussing whether white-hat recovery of stolen funds is plausible.

    seen · Captured here 52,408 chars
    What changed from the previous capture 16 lines 
     If they could even afford to be, that is 
 
 (From an ethical perspective. Legally, they may find a way to weasel out of it).
+
+comment: p2jigqo
+parent: t1_p2iid9f
+author: Electronic_Cover_134
+created_utc: 1786227781
+edited: false
+body:
+What's odd is you believe in the white hats lol
+
+comment: p2k095a
+parent: t1_p2jigqo
+author: n8dahwgg
+created_utc: 1786233726
+edited: false
+body:
+I mean, I know the guy so I know of at least one
    Extracted text as captured 
    post: 1vemip7
author: Affectionate_Tea3401
created_utc: 1785783523
title: Your keys, not your crypto. A 330K lesson for all.
body:
I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe \~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

\- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff  
\- Last bull run started after the FTX crash, LFG!  
\- Nothing stops this train, whatever ever doesn't kill us makes us stronger  
\- Hardware wallets are a marketing scam  
\- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  4. source content difference between and source content +54 -0

    The victim thread gained several new comments, including relief at not owning a COLDCARD, commiseration over past exchange losses, calls for Coinkite liability, and suspicion about a dormant account's return.

    seen · Captured here 52,103 chars
    What changed from the previous capture 54 lines 
     I’m using Trezor and ledger.
 
 Can I just get a lightning wallet from you- I’d like to send you some sats! Take it as a sign from the BTC community that there are also (and mostly) very kind and friendly people who like to help each other a bit more!
+
+comment: p2h40xd
+parent: t3_1vemip7
+author: Vagelen_Von
+created_utc: 1786202546
+edited: false
+body:
+I am glad never heard of Coldcard until July 2026.
+
+comment: p2hbzzw
+parent: t3_1vemip7
+author: wangshuying
+created_utc: 1786204842
+edited: false
+body:
+I lost $500,000 on ftx. It was painful at the time. 
+
+Then I made it all back many times over
+
+You will come back stronger
+
+comment: p2hoed7
+parent: t3_1vemip7
+author: AllKnowingFlan
+created_utc: 1786208372
+edited: false
+body:
+Coinkite should be liable, full stop
+
+comment: p2i7wvr
+parent: t1_p1ifem5
+author: Electronic_Cover_134
+created_utc: 1786213858
+edited: false
+body:
+White hat hacker's lol Q 😆 
+
+comment: p2iid9f
+parent: t1_p2i7wvr
+author: n8dahwgg
+created_utc: 1786216884
+edited: false
+body:
+You havent spoken on reddit for 128 days and this js your masterful return comment? Odd…
+
+comment: p2ivtvj
+parent: t1_p2hoed7
+author: AllKnowingFlan
+created_utc: 1786220864
+edited: false
+body:
+If they could even afford to be, that is 
+
+(From an ethical perspective. Legally, they may find a way to weasel out of it).
    Extracted text as captured 
    post: 1vemip7
author: Affectionate_Tea3401
created_utc: 1785783523
title: Your keys, not your crypto. A 330K lesson for all.
body:
I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe \~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

\- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff  
\- Last bull run started after the FTX crash, LFG!  
\- Nothing stops this train, whatever ever doesn't kill us makes us stronger  
\- Hardware wallets are a marketing scam  
\- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  5. source content difference between and source content +34 -0

    The thread gained three new comments: one recommending an offline paper-wallet generator, another expressing sympathy and sharing a smaller loss, and a third offering to send sats via a lightning wallet.

    seen · Captured here 51,032 chars
    What changed from the previous capture 34 lines 
     I will pray that "white hat" hackers manage to return at least a portion of the funds, and that the company is held accountable and reimburses all the victims.
 
 Take care.
+
+comment: p2g8oy1
+parent: t3_1vemip7
+author: Share_coin
+created_utc: 1786192625
+edited: false
+body:
+The only really secure method of cold storage is to use an offline paper wallet generator that is open source, so you know it's not being stored elsewhere.
+
+[https://github.com/technologiespro/paper-wallet-generator](https://github.com/technologiespro/paper-wallet-generator)
+
+  
+I use that and lock the wallet in a safe and emailed to myself in an encrypted file inside a password protected zip file. 
+
+Good luck finding my private keys.
+
+comment: p2gkpxm
+parent: t3_1vemip7
+author: Anxious-Fondant-8929
+created_utc: 1786196714
+edited: false
+body:
+I wish you long life and prosperity my friend! They also got me for .17 BTC. Not as much as you claim but the pain and anger are still there. At the end of the day we can’t take any of this with us when we go and all that we will look back on is the memories we create with the ones we love around us. I was poor and happy. Dreams of riches only brought me anxiety. In Swahili Maisha marefu!
+
+comment: p2gvqwb
+parent: t3_1vemip7
+author: Illustrious-Motor504
+created_utc: 1786200115
+edited: false
+body:
+Wow! What a story! I’m feeling very sorry for you, and is like to wish you all the best for your future.   
+I’m using Trezor and ledger.
+
+Can I just get a lightning wallet from you- I’d like to send you some sats! Take it as a sign from the BTC community that there are also (and mostly) very kind and friendly people who like to help each other a bit more!
    Extracted text as captured 
    post: 1vemip7
author: Affectionate_Tea3401
created_utc: 1785783523
title: Your keys, not your crypto. A 330K lesson for all.
body:
I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe \~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

\- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff  
\- Last bull run started after the FTX crash, LFG!  
\- Nothing stops this train, whatever ever doesn't kill us makes us stronger  
\- Hardware wallets are a marketing scam  
\- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  6. source content difference between and source content +32 -8

    The Reddit thread gained a long comment defending the victim and blaming the fundamental code error, while a prior brief condolence comment was removed.

    seen · Captured here 49,523 chars
    What changed from the previous capture 40 lines 
     body:
 Imagine if you just put this money and effort into a stable investment on a reputable investment platform lmao. 
 
-comment: p1skcvk
-parent: t3_1vemip7
-author: HeyDontSkipLegDay
-created_utc: 1785904522
-edited: false
-body:
-Sorry for your loss
-
 comment: p1x9o47
 parent: t3_1vemip7
 author: BillLow4780
 edited: false
 body:
 Cold card company should refund everyone that trusted then with their life savings to make things right but they wont
+
+comment: p2cdwgn
+parent: t3_1vemip7
+author: Firm_Yogurtcloset835
+created_utc: 1786137173
+edited: false
+body:
+First of all, I am very sorry for your loss; I wish your father a speedy recovery and hope everything is well with you, your daughter, and your family.
+
+Thank you for sharing your stories and thoughts.
+
+Regarding some of the replies you received: it is very easy—after the milk has already spilled—to point fingers and say you should have stayed close while it was boiling (without showing any empathy or understanding the full context of why you were away from the stove at that moment).
+
+To be realistic, hardware wallets have helped with BTC adoption, and it is highly hypocritical for anyone to say things like "it was just the dice roll" or "it was just the passphrase."
+
+If not for that extremely serious and fundamental developer error in the code (which warrants an investigation into whether it was truly just a mistake), this topic wouldn't even exist—regardless of dice rolls or passphrases—because the entropy would have met current security standards.
+
+True Bitcoin holders and members of the Bitcoin community would never accuse or blame the victim in a situation like this.
+
+To the "adventurers" and know-it-alls: I wish you no ill will, but I do ask that you rethink your values ​​and your outlook on life.
+
+Blaming the victims in this case is unacceptable.
+
+The company had a mission when selling its product; the single most important aspect of a hardware wallet is seed generation, and that has absolutely nothing to do with dice rolls... again, if the code had been correct, we wouldn't be here discussing this topic.
+
+It was a basic, grotesque, and incompetent error—setting a variable to zero in the code... it makes me choke with anger just writing about it.
+
+It needs to be investigated.
+
+I will pray that "white hat" hackers manage to return at least a portion of the funds, and that the company is held accountable and reimburses all the victims.
+
+Take care.
    Extracted text as captured 
    post: 1vemip7
author: Affectionate_Tea3401
created_utc: 1785783523
title: Your keys, not your crypto. A 330K lesson for all.
body:
I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe \~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

\- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff  
\- Last bull run started after the FTX crash, LFG!  
\- Nothing stops this train, whatever ever doesn't kill us makes us stronger  
\- Hardware wallets are a marketing scam  
\- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  7. source content difference between and source content +8 -0

    The thread gained a comment stating that Coinkite should refund everyone who trusted the device with life savings.

    seen · Captured here 47,655 chars
    What changed from the previous capture 8 lines 
     edited: false
 body:
 Stay strong. I wish you the best and I am sorry.
+
+comment: p2axbov
+parent: t3_1vemip7
+author: Chase718
+created_utc: 1786123254
+edited: false
+body:
+Cold card company should refund everyone that trusted then with their life savings to make things right but they wont
    Extracted text as captured 
    post: 1vemip7
author: Affectionate_Tea3401
created_utc: 1785783523
title: Your keys, not your crypto. A 330K lesson for all.
body:
I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe \~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

\- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff  
\- Last bull run started after the FTX crash, LFG!  
\- Nothing stops this train, whatever ever doesn't kill us makes us stronger  
\- Hardware wallets are a marketing scam  
\- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  8. source content difference between and source content +2 -10

    Reddit now marks a supportive commenter as deleted and their comment as removed.

    seen · Captured here 47,439 chars
    What changed from the previous capture 12 lines 
     
 comment: p1ih75s
 parent: t3_1vemip7
-author: dyedsthaytuned7
+author: [deleted]
 created_utc: 1785786936
 edited: false
 body:
-Losing that much, especially when it was for your daughter, is brutal.... Youre not alone in feeling angry and shaken and its okay to step back from BTC from a while. Wishing you and your dad strength !
+[removed]
 
 comment: p1ihl7n
 parent: t3_1vemip7
 body:
 Imagine if you just put this money and effort into a stable investment on a reputable investment platform lmao. 
 
-comment: p1pr8iv
-parent: t1_p1ijkxu
-author: dyedsthaytuned7
-created_utc: 1785872810
-edited: false
-body:
-no problem at all, I wish you the best! 
-
 comment: p1skcvk
 parent: t3_1vemip7
 author: HeyDontSkipLegDay
    Extracted text as captured 
    post: 1vemip7
author: Affectionate_Tea3401
created_utc: 1785783523
title: Your keys, not your crypto. A 330K lesson for all.
body:
I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe \~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

\- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff  
\- Last bull run started after the FTX crash, LFG!  
\- Nothing stops this train, whatever ever doesn't kill us makes us stronger  
\- Hardware wallets are a marketing scam  
\- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  9. source content difference between and source content +8 -0

    Reddit added a brief supportive comment to the reported-loss account.

    seen · Captured here 47,784 chars
    What changed from the previous capture 8 lines 
     edited: false
 body:
 Sorry for your loss
+
+comment: p1x9o47
+parent: t3_1vemip7
+author: BillLow4780
+created_utc: 1785960064
+edited: false
+body:
+Stay strong. I wish you the best and I am sorry.
    Extracted text as captured 
    post: 1vemip7
author: Affectionate_Tea3401
created_utc: 1785783523
title: Your keys, not your crypto. A 330K lesson for all.
body:
I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe \~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

\- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff  
\- Last bull run started after the FTX crash, LFG!  
\- Nothing stops this train, whatever ever doesn't kill us makes us stronger  
\- Hardware wallets are a marketing scam  
\- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  10. source content difference between and source content +8 -0

    The thread gained a brief reply expressing sympathy for the reported loss.

    seen · Captured here 47,634 chars
    What changed from the previous capture 8 lines 
     edited: false
 body:
 no problem at all, I wish you the best! 
+
+comment: p1skcvk
+parent: t3_1vemip7
+author: HeyDontSkipLegDay
+created_utc: 1785904522
+edited: false
+body:
+Sorry for your loss
    Extracted text as captured 
    post: 1vemip7
author: Affectionate_Tea3401
created_utc: 1785783523
title: Your keys, not your crypto. A 330K lesson for all.
body:
I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe \~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

\- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff  
\- Last bull run started after the FTX crash, LFG!  
\- Nothing stops this train, whatever ever doesn't kill us makes us stronger  
\- Hardware wallets are a marketing scam  
\- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  11. source content difference between and source content +18 -0

    The Reddit thread gained new participant comments.

    seen · Captured here 47,507 chars
    What changed from the previous capture 18 lines 
     body:
 I just know the person on a personal level. I really admire him for taking the risk to do it. Not going to dox him unless he wants the world to know.
 
+comment: p1mzpij
+parent: t3_1vemip7
+author: BeginningBeautiful69
+created_utc: 1785846731
+edited: false
+body:
+So sorry to read your story. You did everything right. This could have been anyone. Just plain shitty luck. So many hopes and plans wrecked. Concentrating on family time now. My fingers well and truly crossed for you that those bitcoin make their way back to you some day. 🤞 
+
+Your point about the number of 'told you so' dice rolling multisig experts coming out of the woodwork resonates. I too thought coldcard to be the gold standard, obviously without verifing the TRNG code (I mean, come the fuck on). Good speed. 
+
 comment: p1n4rcy
 parent: t1_p1k6hgm
 author: Even_Routine5011
 body:
 Isnt the term "ugly on the inside" or are you saying they are physically ugly? 😂
 
+comment: p1n5o4h
+parent: t1_p1ifrjp
+author: Even_Routine5011
+created_utc: 1785848587
+edited: false
+body:
+I recently just had a 1 one ounce gold Canadian maple stolen from me so I've been more pissed with Gold recently than Bitcoin
+
 comment: p1ndohg
 parent: t1_p1l9gdr
 author: n8dahwgg
    Extracted text as captured 
    post: 1vemip7
author: Affectionate_Tea3401
created_utc: 1785783523
title: Your keys, not your crypto. A 330K lesson for all.
body:
I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe \~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

\- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff  
\- Last bull run started after the FTX crash, LFG!  
\- Nothing stops this train, whatever ever doesn't kill us makes us stronger  
\- Hardware wallets are a marketing scam  
\- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  12. source content difference between and source content +8 -0

    The Reddit thread gained 1 new comment.

    seen · Captured here 46,644 chars
    What changed from the previous capture 8 lines 
     edited: false
 body:
 Imagine if you just put this money and effort into a stable investment on a reputable investment platform lmao. 
+
+comment: p1pr8iv
+parent: t1_p1ijkxu
+author: dyedsthaytuned7
+created_utc: 1785872810
+edited: false
+body:
+no problem at all, I wish you the best!
    Extracted text as captured 
    post: 1vemip7
author: Affectionate_Tea3401
created_utc: 1785783523
title: Your keys, not your crypto. A 330K lesson for all.
body:
I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe \~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

\- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff  
\- Last bull run started after the FTX crash, LFG!  
\- Nothing stops this train, whatever ever doesn't kill us makes us stronger  
\- Hardware wallets are a marketing scam  
\- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  13. source content difference between and source content +0 -8

    An existing Reddit comment no longer appeared in the captured thread.

    seen · Captured here 46,498 chars
    What changed from the previous capture 8 lines 
     body:
 Sorry man,family is the nly thing we really have…question for the community? I’m not a tech guy but iv managed to stash coins on 3 trezors..Does the community think trezors are still safe…
 
-comment: p1k2vbz
-parent: t3_1vemip7
-author: panthera_NN
-created_utc: 1785803761
-edited: false
-body:
-I've always been worried about someone creating a seed phrase similar to mine, so I used a passphrase. Theoretically, using a passphrase still doesn't prevent someone from accidentally creating a seed phrase that could potentially access my wallet, because the 24 seedphrases plus the 25th passphrase still have a chance of matching another 24 seedphrases. I did it for peace of mind. However, coincidentally, a strong 25th passphrase can save a weak/flawed 24-seedphrase, so this should be a mandatory requirement when creating a new wallet, and the passphrase should include uppercase and lowercase letters, numbers, special characters, and a minimum length to be accepted, just like when you create a password for an online account. I'm very sorry for your loss. After this incident, I've also upgraded my passphrase to be a bit longer. Previously, I split the money between two places, but I wasn't serious enough about it. Now I will be truly serious about this.
-
 comment: p1k6hgm
 parent: t1_p1j681q
 author: elfwriter
    Extracted text as captured 
    post: 1vemip7
author: Affectionate_Tea3401
created_utc: 1785783523
title: Your keys, not your crypto. A 330K lesson for all.
body:
I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe \~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

\- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff  
\- Last bull run started after the FTX crash, LFG!  
\- Nothing stops this train, whatever ever doesn't kill us makes us stronger  
\- Hardware wallets are a marketing scam  
\- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  14. source content difference between and source content +8 -0

    1 new Reddit comment was posted, by Patched7fig, recommending conventional investments.

    seen · Captured here 47,567 chars
    What changed from the previous capture 8 lines 
     That is an insane amount of money to lose, its literally a house value. This is coming from somoeone also who is responsible and did the right thing. Nobody can steal your house ownership, by stealing your keys. This a fundamental risk to Bitcoin and Crypto, it will be interesting to see how things will move. I am a big Bitcoin believe since a long time, but Im also more AI aware, and I can see more of these cases in the near future. Crypto will be the easiest target with these AI insane hacking abilities that will only get better. 
 
 
+
+comment: p1oc7qt
+parent: t3_1vemip7
+author: Patched7fig
+created_utc: 1785859998
+edited: false
+body:
+Imagine if you just put this money and effort into a stable investment on a reputable investment platform lmao. 
    Extracted text as captured 
    post: 1vemip7
author: Affectionate_Tea3401
created_utc: 1785783523
title: Your keys, not your crypto. A 330K lesson for all.
body:
I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe \~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

\- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff  
\- Last bull run started after the FTX crash, LFG!  
\- Nothing stops this train, whatever ever doesn't kill us makes us stronger  
\- Hardware wallets are a marketing scam  
\- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  15. source content difference between and source content +10 -0

    1 new Reddit comment was posted, by Sensitive-Dish-7770, on the financial impact and perceived AI-related risk.

    seen · Captured here 47,353 chars
    What changed from the previous capture 10 lines 
     edited: false
 body:
 I’m so sorry this has happened to you and your family. I’m wishing for a miracle for you and your family that changes everything for you going forward. Have a blessed day.
+
+comment: p1o1ejr
+parent: t3_1vemip7
+author: Sensitive-Dish-7770
+created_utc: 1785857252
+edited: false
+body:
+That is an insane amount of money to lose, its literally a house value. This is coming from somoeone also who is responsible and did the right thing. Nobody can steal your house ownership, by stealing your keys. This a fundamental risk to Bitcoin and Crypto, it will be interesting to see how things will move. I am a big Bitcoin believe since a long time, but Im also more AI aware, and I can see more of these cases in the near future. Crypto will be the easiest target with these AI insane hacking abilities that will only get better. 
+
+
    Extracted text as captured 
    post: 1vemip7
author: Affectionate_Tea3401
created_utc: 1785783523
title: Your keys, not your crypto. A 330K lesson for all.
body:
I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe \~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

\- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff  
\- Last bull run started after the FTX crash, LFG!  
\- Nothing stops this train, whatever ever doesn't kill us makes us stronger  
\- Hardware wallets are a marketing scam  
\- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  16. source content difference between and source content +8 -0

    1 new Reddit comment was posted, including KSTSHoldings.

    seen · Captured here 46,703 chars
    What changed from the previous capture 8 lines 
     edited: false
 body:
 I think those numbers are going to land too optimistically unfortunately. But that being said it is still substantial 
+
+comment: p1nisms
+parent: t3_1vemip7
+author: KSTSHoldings
+created_utc: 1785852328
+edited: false
+body:
+I’m so sorry this has happened to you and your family. I’m wishing for a miracle for you and your family that changes everything for you going forward. Have a blessed day.
    Extracted text as captured 
    post: 1vemip7
author: Affectionate_Tea3401
created_utc: 1785783523
title: Your keys, not your crypto. A 330K lesson for all.
body:
I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe \~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

\- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff  
\- Last bull run started after the FTX crash, LFG!  
\- Nothing stops this train, whatever ever doesn't kill us makes us stronger  
\- Hardware wallets are a marketing scam  
\- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  17. source content difference between and source content +59 -3

    5 new Reddit comments were posted, including AirLawyer,Generationhodl,n8dahwgg.

    seen · Captured here 46,429 chars
    What changed from the previous capture 62 lines 
     parent: t3_1vemip7
 author: jannies_doit_4_free
 created_utc: 1785816813
-edited: false
-body:
-I'm not reading all that, but your premise is wrong. all that's "changed" with this is that people are now aware that not all entropy is equally perfect so to either generate it themselves or have another layer of security. that's it. everything else is the same as it always was
+edited: 1785841506
+body:
+I'm not reading all that, but your premise is wrong. all that's "changed" with this is that people are now aware that not all entropy is equally perfect so to either generate it themselves, verify the 3rd-party entropy if possible, or simply have another layer of security. that's it. everything else is the same as it always was.
+
+even on top of that, the principle doesn't carry over to other, proper forms of RNG; it's like the scale of finding an atom in bacteria to the scale of finding an atom in 11 milky ways if the bug hadn't existed due to poor coding.
 
 comment: p1l4dtm
 parent: t3_1vemip7
 edited: false
 body:
 I think they're going to catch these guys. Don't give up hope.
+
+comment: p1mjl1r
+parent: t3_1vemip7
+author: AirLawyer
+created_utc: 1785840901
+edited: false
+body:
+OP, I DM’d you. Let’s talk 
+
+comment: p1mmynf
+parent: t3_1vemip7
+author: Generationhodl
+created_utc: 1785842249
+edited: false
+body:
+"So maybe I won't give my daughter 5BTC, what I can give her today is time, love and attention and those are irreplaceable."
+
+This is the most important part here..
+
+As a kid, the most precious thing is loving parents and time with them.
+
+As a kid I didn't give any fuck about if we have money or not, but I had the time of my life because my parents cared about me, and this hold till today. 
+
+I wish and want my parents to spend all their money on themself because I love them and want them to have a good time, or the best time until the end. - I'm an adult and I will go through my life just fine on my own. 
+
+We often lose ourselves while stacking sats or trying to get wealthy / rich, but we forget that we cannot take anything into afterlife and we only have the time here and now with our loved ones.
+
+So even if you lose money, and it sucks really hard, just think about what is the most important thing in your life and be happy that you have time right now (and hopefully health) to spend with your loved ones and friends.
+
+
+
+comment: p1mpccw
+parent: t1_p1l60wq
+author: n8dahwgg
+created_utc: 1785843155
+edited: false
+body:
+I just know the person on a personal level. I really admire him for taking the risk to do it. Not going to dox him unless he wants the world to know.
+
+comment: p1n4rcy
+parent: t1_p1k6hgm
+author: Even_Routine5011
+created_utc: 1785848312
+edited: false
+body:
+Isnt the term "ugly on the inside" or are you saying they are physically ugly? 😂
+
+comment: p1ndohg
+parent: t1_p1l9gdr
+author: n8dahwgg
+created_utc: 1785850912
+edited: false
+body:
+I think those numbers are going to land too optimistically unfortunately. But that being said it is still substantial
    Extracted text as captured 
    post: 1vemip7
author: Affectionate_Tea3401
created_utc: 1785783523
title: Your keys, not your crypto. A 330K lesson for all.
body:
I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe \~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

\- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff  
\- Last bull run started after the FTX crash, LFG!  
\- Nothing stops this train, whatever ever doesn't kill us makes us stronger  
\- Hardware wallets are a marketing scam  
\- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  18. Earliest copy held
    seen · Captured here 44,221 chars
    Extracted text as captured 
    post: 1vemip7
author: Affectionate_Tea3401
created_utc: 1785783523
title: Your keys, not your crypto. A 330K lesson for all.
body:
I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe \~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

\- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff  
\- Last bull run started after the FTX crash, LFG!  
\- Nothing stops this train, whatever ever doesn't kill us makes us stronger  
\- Hardware wallets are a marketing scam  
\- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.