I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus –> BTC, family gifts –> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.
I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe ~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.
When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.
However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.
Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.
At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.
Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.
The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!
Update 1:
I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:
– You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff
– Last bull run started after the FTX crash, LFG!
– Nothing stops this train, whatever ever doesn't kill us makes us stronger
– Hardware wallets are a marketing scam
– We will get through this together. (be honest, we are not)
I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.
There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?
Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:
- Not your keys, not your crypto
- Get your BTC off the exchanges
- Sell your kidney if you must
- You can never have enough bitcoin
Hadn't this happened I would have probably tattooed those phrases on my chest. But today I am rethinking.. why? Why wasn't 1 BTC or 2 BTC or 3 BTC enough for me? Suddenly, having cash in the bank seems like a good deal. 3rd party custody with a regulated exchange? Awesome! S&P500? Even better! Real estate? Best thing ever. I got greedy and with greed comes hubris.
Take it from someone who went all in and thought he had everything figured out and covered. Reconsider everything, how you store your coins, your investments, your diversification, everything. When FTX happened I was not directly affected, I just felt the market pain. I was naive thinking, well this is why I self custody, this won't happen to me. If you saw the coldcard exploit and thought this won't happen to me, please think again. BTC even today feels like the best risk/reward investment one could enter but the chances of going to 0 because an AI in 5 years will figure out something no one has so far, are not 0.
So maybe I won't give my daughter 5BTC, what I can give her today is time, love and attention and those are irreplaceable. I might get back to 5BTC one day (who am I kidding) but you never get back lost time. Seeing my father suffering today just brought me back to reality. It was just numbers on the screen, surely the screen now reads 0 but I still have my loved ones around.
Seize the day and don't trust anyone, even yourself.
Your keys, not your crypto. A 330K lesson for all.
byu/Affectionate_Tea3401 inBitcoin
Posted by Affectionate_Tea3401
14 Comments
We have been sharing stories for years, as phrases have been hacked but it was all dismissed because it was “impossible”. I hope now you understand the lies, the misinformation, and with your own eyes realize it was never secure, it was just so “random” that no one believed anyone’s story until it happened like this. It happened to me but I was told every which way that it was my fault.
This is a wake up call. Not your keys, not your crypto…. also not your crypto when your keys get hacked.
I’d suggest if you still ever have any desire to look into bitcoin, check the ETFs or have your broker hold your “small” 10% of your portfolio investment and “lock” your account where you can bring crypto in but can’t send it out. You can do this. Unless your broker, fidelity, charles schwab or robinhood goes out of business, they have CRIME insurance. Maybe not federal, but it is insured. These brokers protect your 401k (if in the US), but you are scared they will lose your 24K in bitcoin?
Insane.
This would have been a perfect example of how you could have had insurance on your investment because due to all the stolen funds going to the same wallet, you could prove your funds disappeared to that wallet. Pretty much an easy claim. Food for thought.
Your anger will grow, because you will see the same mistakes happen again, the same people claiming cold wallets are the way, and again, watching those who didn’t experience this stand on their soap box and tell you all the ways they were never worried. I mean, they have 1 bitcoin spread into 300000 different wallets, with half the phrases stored in ancient tombs, and the other half tattooed inside their eyelids. But it can’t be seen unless they are in a black room. Crazy stuff. Bitcoin is the future, as is AI, but not like this.
First of all, I wish strength to your dad and hope he recovers soon!
As for BTC, here’s something positive there:
You now have gained extremely valuable and unique experience about investments and their place in our lives. If used correctly, this experience will make you tenfold down the line of your generations.
Good luck
Have you got the address, so this can be verified please?
I got downvoted all to hell last time I mentioned this, but there are some white hat hackers on the case who are working with FBI and chain analytics to return funds appropriately. Not everything that was stolen were from bad guys. Keep your old coldcard just in case. It might not all be lost.
I’d suggest branching out and investing in more than just bitcoin. Theres stocks, Precious metals, Collectibles. Precious Metals. Oh and Gold & Silver!.. I like bitcoin but I don’t trust it enough to have more than maybe 10% of total networth into it.. Theres lots of better places to park your money. Sorry you lost so much that really bites.
“People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn’t mean there isn’t a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security.”
You can actually just roll dice and convert the results into BIP39 words yourself, no special wallet feature is necessary for this. All you need to do is use a wallet feature or a computer program (secure, offline, using Tails OS) to generate the 24th checksum. Even if this feature implementation is faulty, malicious etc. you will immediately notice because the seed can’t be initialized.
I wish you and your family a joyous and prosperous life. Thank your for sharing your story.
You’re a legend man
Losing that much, especially when it was for your daughter, is brutal…. Youre not alone in feeling angry and shaken and its okay to step back from BTC from a while. Wishing you and your dad strength !
I was hacked 7 years ago and lost 5 grand with crappy sh!!t coins but this was when Bitcoin was around 6k. Then when ledger was compromised and all users info dumped that was another dagger to the heart.
Don’t give up, these devastating events are nothing but ‘blips’ in your lifetime. Soon enough time will pass by and you’ll think back and go, yeah that sucked but you came out of all that as a stronger and much wiser individual! You can do it 👍
Thank you for taking your time with us. It’s really hearth braking, I can only imagine what you are feeling right now. I’m very sorry.
You are right, after all it’s only a small part of our lives. You don’t need much to be happy.
The lesson here is for everyone of us. Don’t be too greedy, don’t risk it all, being in Bitcoin, meme stocks, index funds or real estate. Diversify and try your best to protect what you have, and not to make 500% gains in a year.
The community failed on itself, the developers and coders failed their customers with a unforgivable mistake, and victims are the last one to be blamed.
Only thing to do now is to look at it as an airplane crash. We have to learn from it and never allow to happen again. All other hardware wallet manufactures have to be 100% focus on secure customer assets, review code on a daily base if needed, and let new features and marketing to second. The victims have to reunite strengths and carry on. Best wishes for you and your family.
Hang in there buddy. All the Bitcoin in the hacker’s wallet isn’t worth your health, and time is precious. You still have the most important things in life, dont let the hackers steal them from you by making you sick and bitter. Sounds like you won’t.
And postpone total despair for a little longer: let’s see how things play out, with AI powered forensic tools and a more modern intl regulatory regime. In the end, it worked out for a lot of Goxxers.
Hope you get strength to deal with this.
I agree with whatever you mentioned here. We can think we are smarter than others but you never know because not everything is in ur control and not everything is ur fault.
Why aren’t people spreading their btc across wallets? At one point I had 1 btc and even then I had it split between two wallets. There’s no way I’d leave 5 btc on a single wallet.