Post

Cold wallets are no longer safe: Coldcard firmware vulnerability, Ledger supply chain attack—does your BTC really belong to you? You spent 1000 yuan on a cold wallet, thinking your assets were completely secure. Within a year, two incidents told you—cold wallets can also be ticking time bombs. The first bomb: Coldcard, you never even touched the device, but your money is gone. In March 2021, Canadian hardware wallet manufacturer Coinkite introduced a fatal flaw in Coldcard firmware: when the device generated the mnemonic phrase, it did not call the real hardware random number chip but used a software pseudo-random number generator instead. Simply put—you thought it was "random," but it wasn’t. Attackers didn’t need to touch your device or even have you online; they could mathematically deduce your mnemonic phrases in bulk. The first attack occurred on July 30, 2026. About 594 BTC disappeared from 500 addresses within 25 minutes. This was just the beginning. At least three more waves of attacks followed, ultimately transferring over 1,816 BTC from more than 5,200 addresses, with losses estimated between 114 million and 116 million USD. One user said his Coldcard was never connected to the internet, and his mnemonic phrase was never leaked, yet his assets were still stolen. Coinkite’s official response was just one sentence: all mnemonic phrases generated since March 2021 should be considered potentially compromised. Firmware upgrades don’t help—the already generated mnemonic phrases are permanently unsafe; you must create new mnemonics and transfer your assets. The second bomb: Ledger, the device you bought from a dealer might have been tampered with. On October 9, Ledger users suffered a massive theft, losing over 86 million USD, involving hundreds of wallets across Ethereum, TRON, Bitcoin, and other chains. The victims shared one common trait: all purchased devices through Southeast Asian dealer CryptoBilis. Former Mt. Gox CEO Mark Karpelès opened a Ledger from Malaysia and found an extra circuit board inside, equipped with an LTE module and eSIM. This board could read signals sent to the screen, intercept mnemonic phrases during device initialization, and transmit them via mobile network. You thought it was an "official authorized dealer," but the device had been disassembled, modified, and tampered with since it left the factory. The more painful signal is: the entire DeFi infrastructure’s security assumptions are being broken down one by one. Balancer was hacked for 128 million USD, Kelp DAO lost 292 million USD, Stream Finance’s synthetic USD xUSD depegged, and Aave’s total locked value dropped from 26 billion to 14.2 billion in 5 days. From lending protocols to synthetic USD, from exchanges to personal hardware wallets—every "secure" link you trusted has had incidents this year. What should you do? Three things, do them today. First, buy hardware wallets through official channels. Don’t be cheap and buy from dealers or third parties. The Ledger incident has already shown you that supply chain attacks hide behind the words "authorized dealer." Second, Coldcard users must check immediately. If you generated mnemonic phrases on Coldcard after March 2021, create a new wallet and transfer your assets today. Old mnemonic phrases are permanently unsafe. Third, use multisig for large assets. Single-signature wallets were the main target of the Coldcard attack. Use a 2-of-3 multisig composed of Trezor Safe 7, Ledger Nano, and Casa recovery keys. If any single device fails, your assets remain safe. Don’t put all your eggs in one basket—especially don’t entrust your private keys to a single device. 1011 taught us leverage kills. This year teaches us—even cold wallets can betray you. In this market, the only enemy of security is your luck. $BTC $ETH $ZEC #Ledger确认一台涉事设备遭硬件植入