Jeez. The guy doing this must be 5-star wanted by now.

There's going to be a huge manhunt for sure once they trace the bitcoins.

I am really scared after reading this thread. 

Especially when philipma1957 said that he has already sold his 30% holding, it makes me even more scared.

Can anyone please tell me if my funds in the Electrum wallet are safe, or should I move my funds from Electrum now?

If not, then could this same incident happen to Electrum wallet users in future?

Electrum users are not affected, only some Coldcard users were affected.

Create a new wallet on Electrum but with a passphrase that will be difficult to brute force.

It is better you have your bitcoin on more wallets instead of one. I am not talking about more wallets of the same wallet brand but I am talking about more wallet on different wallet brands that are good and trustworthy with passphrase.

Everyone affected should not throw away or smash their Coldcard devices is here why.
https://x.com/zherbert/status/2083261221726220638?s=20

Yes, it's a depressing experience to use various methods to accumulate BTC for months or years only for someone to come and steal it, but it also serves as an eye-opener that using a passphrase or multisig should be our top priority. According to what I read about the attack, the funds in the wallet that used it are safe

well, I assume most of the data is stored in Mixer. nothing to deny.

Actually mixer is a neutral privacy tool.
So, main problem here is not the existence of mixer company. Actual problem is how a leading hardware wallet provider failed to protect the security of its users core keys in the first place!

I know that there is no point in complaining about what happened already. But at least we could hold our vendors accountable for security flaws. They should not be allowed to escape responsibility anyhow.

It will also be good if the seed phrase or the keys of the multisig wallet is generated on different wallets and not generate all the keys on the same wallets. In a 2 of 3, you can generate one key on Electrum, the second key on Sparrow and the third key on Trezor.

Know that multisig is good but anyone that want to use it should be very careful and do a proper seed phrase backup.

Since im not a specialist on this matter and most of you knows a lot more than me i dont want to say something that is wrong so im gonna limit me to only said i feel sorry for all of those who lose his precious BTC in this issue, i really feel sorry for them, i cant understand how much pain some of them are gonna feel when you discover maybe all your funds saved to the rest of your life or supporting your actual life are gone thanks to this fail and some shit persons.

As always i can recomend the msot easy thing to do in life with everything, dont put everything in the same basquet. Spread it the most you can. I know is a little more work but that could safe you always.

Electrum itself is secure.  The risk lies in where the seed phrase was generated.  Your funds are only at risk if your Electrum wallet is acting as a software interface for a Coldcard hardware wallet or if you imported a seed phrase created on one, depending on the device firmware at the time of creation.


Its hard to say what the future holds.  Theoretically, any wallet software or hardware device that relies on a Pseudo-Random Number Generator (PRNG) to create private keys and seed phrases can suffer from an entropy flaw.  But it is highly unlikely that such a mistake would happen to Electrum developers, especially considering that it is a very popular software with completely open source code that is checked and tested by many people.

It appears that some versions of the Coldcard MK4 and MK5 are also partially compromised, having generated seeds with 72 bits of entropy instead of the standard 128 bits. This could be another major flaw in the Coldcard system that should not be overlooked.

One thing is certain: unfortunately, today we have witnessed a dark chapter in the history of Bitcoin, perhaps the darkest yet, given how it unfolded and how defenceless it left us.

I don’t use ColdCard, thank goodness, but I must say I won’t be sleeping soundly tonight, despite all the precautions I have taken for my wallet (offline keys, device always offline, private keys stored offline, etc.).
This was not a leak of private keys, or phsicological engineering, they solved the algorithmic and entropic structure under this bitcoin seed generator for a little error in a source code, in AI era, it's absurd.

I think I don't sleep soundly for some nights. Bitcoin is the dream that Satoshi gift to us, we must do everything we do to preserve it.

Maybe it’s time to think of something new for preserve the self custody.