As if last year hasn't been hard enough on the holdlers, last week what used to be the safest way to store Bitcoin turned out to be the fastest way to lose it when Cold Card, a securityobsessed airgapped Bitcoin hardware wallet, was hacked. The bad news is that a lot of people lost a lot of money. But the good news is that it's only about half as much as they would have lost if the same thing happened a year ago. Since July 30th, attackers have drained over 1,600 Bitcoin worth about $und00 million from over 7,000 wallets. And the craziest part is that they pulled it off without any malware, fishing, or lead pipes. The victims weren't your typical degenerates clicking random Discord links either. They were the responsible ones with the not your keys, not your crypto tattoos, lecturing you about how you don't actually deserve freedom if your coins were on an exchange. In today's video, we'll dive into how the hack works and learn why victims are now bidding against the hackers in real time to try to buy back their own money. It is August 5th, 2026, and you're watching the Code Report. If you've never seen your net worth drop 60% in a day, you may not know that the way Bitcoin works is that your coins are controlled by a private key, which comes from a 12-word seed phrase. If you have those words, you have the Bitcoin. And since the entire security model depends on those words being unguessable, they're chosen by your wallet using a random number generator. A properly generated seed phrase has 128 bits of entropy, which means if you tried a billion guesses per second, the universe would end before you got close. And this principle is exactly why hardware wallets exist in the first place. To generate keys on a dedicated offline device with a special chip whose entire job is to harvest genuine randomness from the physical universe. And no device took this more seriously than Cold Card made by Canadian company Coite. It's airgapped, open- source, and marketed to people who were worried the government is going to make you get a license to make toast in your own damn toaster. But it doesn't matter how sophisticated your random number generator is if you never actually use it. And for the last 5 years, without them knowing, the cold card never did. Here's how it happened. The cold card's firmware runs on micro Python, which ships its own basic random number generator, which was built for simple jobs, but it's nowhere strong enough for generating keys. Coin Kite knew this, so they wrote their own generator, and by setting a specific flag to zero, they disabled MicroPython's generator, or at least that's what they thought. But here's where things went wrong. But both number generators exposed a function with the exact same name and the crypto library would decide which one to use based on an if not defined check. And because the flag was technically defined just as a zero, the check passed and every seed phrase was generated by the basic MicroPython number generator, not cold card sophisticated generator. But it turns out because a bare metal chip has no operating system, there's nowhere for MicroPython's number generator to get real randomness from. So instead, it fakes it using the chip serial number and a timer, both of which are deterministic. So instead of guessing a seed phrase out of every atom in the universe, you could just loop through all possible combinations of serial numbers and timer values and come away with everyone's keys. And on July 30th, that's exactly what the attacker did. In under an hour, the first attacker drained over a,000 Bitcoin from nearly,200 addresses, hitting the biggest wallets first. Then two more attacks happened over the weekend which pushed the total to nearly 1,800 Bitcoin from over 7,000 addresses. A Coin Kite CEO apologized and took full accountability, but by the nature of the attack, they couldn't just issue a firmware update to solve the problem. Because Bitcoin has no way to rotate a key, the only way out is for victims to generate a brand new seed and move their coins with an actual onchain transaction. But of course, because this is Bitcoin, every transaction waits in the public memool until a minor includes it in a block, which means the attacker can just watch the memool for anything coming from a compromised address. They can then sign their own competing transaction with the same keys and a higher fee, and miners will confirm the highest bidder first. So when a fourth attack went live on Monday morning, the only way to win was to skip the public mem poolool entirely and send your rescue transaction directly to a mining pool. Since the bot can't outbid a transaction it never sees. So yeah, the official rescue plan for your trustless decentralized money was to put all your trust in one centralized minor and hope for the best. As for Quinkite, every unsold device in their warehouse carried the same broken firmware, so they had to halt shipments and take their remaining inventory out to the pasture. But all of this could have been avoided had they just built their product with Lovable, the sponsor of today's video. Lately, I've been wanting to make the world a better place. So, I use Lovable's AI development platform to build my own predictions market, which lets you gamble away your life savings on things like future video topics or how many scam Altman jokes I'll make this month. I started with plan mode where lovable mapped out the flow and let me edit the plan before writing any code. Then, it built the whole thing including O payments and a managed Postgress database on lovable cloud. It did get stuck in a loop on a database policy bug, but then I moved back into plan mode and lovable was able to fix it on its own. Then I gave the app its own MCP server is so that right here in Claude Code I can pull live odds or halt trading whenever I'm losing a bet to make sure the house always wins. Over 50 million projects have already been built with lovable and you can try it out for free today with the link below. This has been the code report. Thanks for watching and I will see you in the next one.
Generated algorithmically for Search Engine
Indexing.