r/Bitcoin: relay of the COLDCARD security advisory
reddit-security-advisory-relay
https://www.reddit.com/r/Bitcoin/comments/1vb8taw/security_advisory_for_coldcard_hardware_wallet/
Latest reviewed change
source content difference between and
A comment comparing Trezor entropy sources to COLDCARD was removed by Reddit, with the author shown as [deleted] and the body as [removed].
comment: p0scr24
parent: t1_p0s72yk
-author: 0fWhomIAmChief
+author: [deleted]
created_utc: 1785460851
edited: false
body:
First lines only. The complete diff is in the timeline below.
- Organisation
- Evidence role
- Community discussion
- Published
- not established
- Source changes
- 2
- Detected differences
- 2
- Unreviewed
- 0
- Copies held
- 3
Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .
This post is held twice: here, with this project's own note on why it matters, and again as part of the conversation captured at , which is polled for changes. Both copies are the same post; neither is a separate event.
Snapshot and diff bodies for this chain monitor are held in the local evidence archive but withheld from the public site because they can contain the addresses of people who published nothing themselves. Capture times and reviewed change summaries remain available below.
Held captures
-
A comment comparing Trezor entropy sources to COLDCARD was removed by Reddit, with the author shown as [deleted] and the body as [removed].
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 12 lines
comment: p0scr24 parent: t1_p0s72yk -author: 0fWhomIAmChief +author: [deleted] created_utc: 1785460851 edited: false body: -Trezor models have three different sources of entropy compared to coldcards 1, the newest models have 4 each independent of one another for this exact scenario. We may as well just do what the OGs on Bitcointalk always said, 256 coin flips 馃ぃ +[removed] comment: p0sdq7w parent: t1_p0scr24 >Or will this signal an attacker to brute force passphrases for that seed with crypto The attacker will not know if they get a hold of your seed if you are using an extended passphrase or not . Most people don't so the default assumption is not - -comment: p0sh0oh -parent: t1_p0sdq7w -author: 0fWhomIAmChief -created_utc: 1785462265 -edited: false -body: -Exactly, if any one of the 3 or 4 sources of entropy provided were weak like Coldcards, the other sources provide and retain its 128 bit security, so Trezors are unaffected by this scenario comment: p0si027 parent: t3_1vb8tawExtracted text as captured
post: 1vb8taw author: RetiredAvocado created_utc: 1785451514 title: Security Advisory for Coldcard Hardware Wallet body: Related threads: [https://www.reddit.com/r/Bitcoin/comments/1vatgl4/full\_panic\_one\_of\_my\_wallets\_was\_drained/](https://www.reddit.com/r/Bitcoin/comments/1vatgl4/full_panic_one_of_my_wallets_was_drained/) [https://www.reddit.com/r/Bitcoin/comments/1vb6teq/wallet\_drained\_timeline/](https://www.reddit.com/r/Bitcoin/comments/1vb6teq/wallet_drained_timeline/) comment: p0rkzw9 parent: t3_1vb8taw author: makeshiftballer created_utc: 1785451916 edited: false body: Mannnnn get the popcorn聽 comment: p0rlpny parent: t1_p0rkzw9 author: DirtyDoog created_utc: 1785452136 edited: false body: I checked my wallet, now I can't afford popcorn. comment: p0rmrhl parent: t3_1vb8taw author: CortaCircuit created_utc: 1785452462 edited: false body: >**Out of an abundance of caution, Coinkite is warning all users who generated a seed using a Mk3 on version 4.0.1 (March 2021) or any subsequent version that their funds may be at risk.** >**Mk4, Q and Mk5 are not affected based on our early analysis of the issue.** comment: p0ro0b8 parent: t3_1vb8taw author: [deleted]Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
The Reddit thread gained a request for guidance on generating a seed with dice or coins, including calculating the final checksum word.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 10 lines
edited: false body: The amount of schadenfreude the hackers are feeling right now is through the roof. Don't give them the satisfaction, they are reading everything and finding so much joy through your frustrations. + +comment: p1rp4a5 +parent: t1_p0si027 +author: Buttoshi +created_utc: 1785893370 +edited: false +body: +I want to generate my own seed with dice/coins. How do I go about this? + +I'm stuck on the part of generating the last word/checksum with a paper computer.Extracted text as captured
post: 1vb8taw author: RetiredAvocado created_utc: 1785451514 title: Security Advisory for Coldcard Hardware Wallet body: Related threads: [https://www.reddit.com/r/Bitcoin/comments/1vatgl4/full\_panic\_one\_of\_my\_wallets\_was\_drained/](https://www.reddit.com/r/Bitcoin/comments/1vatgl4/full_panic_one_of_my_wallets_was_drained/) [https://www.reddit.com/r/Bitcoin/comments/1vb6teq/wallet\_drained\_timeline/](https://www.reddit.com/r/Bitcoin/comments/1vb6teq/wallet_drained_timeline/) comment: p0rkzw9 parent: t3_1vb8taw author: makeshiftballer created_utc: 1785451916 edited: false body: Mannnnn get the popcorn聽 comment: p0rlpny parent: t1_p0rkzw9 author: DirtyDoog created_utc: 1785452136 edited: false body: I checked my wallet, now I can't afford popcorn. comment: p0rmrhl parent: t3_1vb8taw author: CortaCircuit created_utc: 1785452462 edited: false body: >**Out of an abundance of caution, Coinkite is warning all users who generated a seed using a Mk3 on version 4.0.1 (March 2021) or any subsequent version that their funds may be at risk.** >**Mk4, Q and Mk5 are not affected based on our early analysis of the issue.** comment: p0ro0b8 parent: t3_1vb8taw author: [deleted]Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 0 lines
Extracted text as captured
post: 1vb8taw author: RetiredAvocado created_utc: 1785451514 title: Security Advisory for Coldcard Hardware Wallet body: Related threads: [https://www.reddit.com/r/Bitcoin/comments/1vatgl4/full\_panic\_one\_of\_my\_wallets\_was\_drained/](https://www.reddit.com/r/Bitcoin/comments/1vatgl4/full_panic_one_of_my_wallets_was_drained/) [https://www.reddit.com/r/Bitcoin/comments/1vb6teq/wallet\_drained\_timeline/](https://www.reddit.com/r/Bitcoin/comments/1vb6teq/wallet_drained_timeline/) comment: p0rkzw9 parent: t3_1vb8taw author: makeshiftballer created_utc: 1785451916 edited: false body: Mannnnn get the popcorn聽 comment: p0rlpny parent: t1_p0rkzw9 author: DirtyDoog created_utc: 1785452136 edited: false body: I checked my wallet, now I can't afford popcorn. comment: p0rmrhl parent: t3_1vb8taw author: CortaCircuit created_utc: 1785452462 edited: false body: >**Out of an abundance of caution, Coinkite is warning all users who generated a seed using a Mk3 on version 4.0.1 (March 2021) or any subsequent version that their funds may be at risk.** >**Mk4, Q and Mk5 are not affected based on our early analysis of the issue.** comment: p0ro0b8 parent: t3_1vb8taw author: [deleted]Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
0 presentation-noise differences. Sidebar, ticker and other page chrome churn that our review classified as not being changes to what the source says.
The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.
Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.
Compare the screenshot or a quotation against the original while it is available.