Cracking Unsafe Bitcoin Wallets + Coldcard Mk4 Warning (Insecure Dice Based Seeds & Private Keys)

A short video that looks at unsafe Bitcoin wallets that were likely created using low numbers of dicerolls leading to poor wallet BIP39 seed security, making it easy for scammers to access the private keys. I also look at how many folk lost funds doing this and which hardware/software could have been used to create these insecure wallets in the first place. It also include a demo of how this can still happen with Coldcard Mk4, even running the latest firmware.

00:00 - Introduction
01:04 - Your Wallet Existed before you Created It
01:12 - About the tool used for cracking wallets (Modified BTCRecover)
01:29 - Which types of wallets were checked
02:09 - What I found
03:20 - The Dilemma of finding wallets with funds...
03:35 - Understanding the Importance of Entropy
03:51 - Ongoing risk for low numbers of dice rolls
04:52 - Checking Wallet Safety (Seedsigner, Krux, Jade, Bitbox02 & Ian Coleman's BIP39 tool)
05:15 - Coldcard Mk4 Issues & Warning
06:33 - Increased risk associated with wallets letting users choose their own seed words
06:54 - Important disclaimer in terms of identifying how these wallets were generated
07:04 - Alternatives
08:18 - Summary and Conclusion

[callumarif]

Steve, thanks for the video friend. Super important information, and good on you for trying to notify the owners of the insecure wallets! Much respect.

[Satssetyoufree]

More people need to be watching this. This guy's videos give excellent security advice.

[normanmckay]

What a legend!! Hats off to you man, thanks for this video!!

[SouthernBitcoiner]

Thanks for covering this. This is important information.

[asteriskesque]

Awesome content. I had a few questions, but you answered them as the video went along. P.S. Thanks for checking Krux! You introduced me to that project in another video & I've become a huge fan.

[charlesbanana]

Greetings from Argentina!!! always good to stay on top of these things. Always appreciate every video This man does.
All the best to you .

[kennethmiller]

Thank you soooo much! I just subscribed.

[sb-qsvj]

Good afternoon Great video and great experiment! To quickly search through BTC, ETH and LTC, you probably had to download their blockchains to your computer? Approximately how much disk space did this take?

[fpico]

Thanks for the great informative video. Is there any way to self check the security of a hardware wallet, to ensure it is safe enough? thanks.

[eagleram]

Great video, subscribed...1000 likes 👍

[bpheard]

For coldca rd, it seems a simple message that says, “insufficient dice rolls”, after you proceed from your dice rolls, would be a very easy safety mechanism.

[anticharlatan]

So true 7:24 "letting the RNG in you wallet generate your seed is actually the most secure thing for most users".
How many coins have been lost due to the RNG in the hardware wallet vs. those lost to brain wallets, not so random dice rolls, etc. I would guess zero vs. hundreds. Keep It Simple! Don't try to outsmart the wallet. I agree 100% with the words at 8:42

[Esteban_]

Hello and thanks for the informative video, If one has a low entropy wallet but with a passphrase, would the addition of the passphrase protect the funds?

[Bruisaanhuis]

Could you please make a practical instructional video about this, showing the best options discussed in this video. So the best options for setting up a Coldcard. What you explain is very difficult to follow for the less technical people here (including me). Thanks!

[bpheard]

Having unfortunately lost some bitcoin because of low entropy, another suggestion I have for the coldcard interface would be, on the screen, where it says 1 to 6, change to one to 99. Simple fix.

[copycatt]

How much bitcoin did you find sitting in these wallets? I don’t think you said in the video. Great video!

[kalkulusrampage]

if you are generating seeds from 2-3 different devices, and each time a new seed is generate you choose the 1st word or the positional word of the new seed generated each time that you need at that moment to complete the defnitive seed until getting the 12 words (11 + checksum), are we getting more entropy or less entropy?

[herman]

Great data. Just one question is there any chance than your hardware wallet provider (like Trezor who is open source) would know your generated seed phrase? and/or passphrase? Thank you

[Cloudstrider]

A tip is not enough for this extremely valuable knowledge! 🙀😅

[Cloudstrider]

How does the BIP85 standard work in concerning the entropy level - does a bad parent seed pass on its low entropy to its child seeds?