Keeping Bitcoin safe has been a tall order. When your crypto gets stolen, it usually ends up overseas in milliseconds – making getting it back turn into an international nightmare.

Compounding this is the ‘Your Keys, Not Your Coins‘ ethos that keeps the hard core Bitcoin users from putting their coins into exchanges (Not that those are very safe either). Worse, there’s no FDIC to protect your losses either. Of course, that also doesn’t stop someone from just showing up at your door, kidnapping you, tying you to a pole, and beating you until you give the keys.

Coldcard sold itself as a completely safe way to keep your bitcoin safe on your own device. It wasn’t attached to the internet so it was considered perfectly safe.

Unless of course the way it picked your secure passwords has a simple coding bug that made the passwords super-easy to guess. Then people could guess your password and then trade them without your knowledge.

And that’s exactly what happened. A simple condition check bug in the code meant that instead of using high-quality cryptography, it used very flawed, easily guessed passwords. Attackers simply used brute force attacks and were able to drain 1,196 wallets in 41 minutes. Since the hack, around $130 million has been stolen. All without the owners every plugging into the internet nor having any clue.