READ THIS IF YOU USE A COLDCARD HARDWARE WALLET

Dear BULL clients,

This is a critically important security advisory for all users of the ColdCard hardware wallet. If you aren’t sure if your hardware wallet is a ColdCard, we have included pictures of them in this blog post.

A critical security bug has been discovered in all coldcard devices (models MK3, MK4, MK5 and Q). It is important to know that this security issue has nothing to do with Bull Bitcoin and we are sending this blog post to our clients to make sure they are aware of the situation.

If you do not use a Coldcard wallet, you do not need to be concerned and you can safely ignore this blog post. 

1. If you have not used a “passphrase” when creating your Coldcard wallet, you are at immediate risk. The “passphrase” is NOT the PIN you enter into the device when you power it on. It’s a special password you enter every time you want to use the device. If you do have a passphrase, you are also at risk but the risk depends on how secure your passphrase (long and complex, preferably random). 
   
   ⁠If you do not remember whether or not you used a passphrase, and if you are not sure if your passphrase is secure or not, assume it is not secure. Do not ask an AI if your passphrase is secure enough, assume it is not.
2. This bug does not affect users that have set up their Coldcard wallets with the “dice roll” option and rolled the dice ~100 times. If you did not roll the dice 100 times, or if you are not sure or you don’t remember, assume that you have been affected.
3. If you did roll the dice, and you do think you have a solid passphrase, you have effectively mitigated the risks of this attack. However, we strongly encourage you to upgrade your wallet security setup calmly and without rushing. 

What to do next

If you aren’t sure if you rolled the dice, or if you aren’t sure if you have a passphrase, or if you aren’t sure if your passphrase is secure enough, you must take action immediately and move the funds out of the Coldcard wallet you are currently using. We suggest 2 options.

However, we must caution you. Doing an emergency migration of your funds can be stressful and you are at risk of doing a mistake if you are anxious and in a hurry. We recommend these 2 Bitcoin consulting firms, which we trust and that we have worked with in the past. These firms specialize in helping Bitcoin users with their wallet security and privacy setups. They charge consulting fees.

• Bitcoin Mentor
• The Bitcoin Way

You can reach out to our customer support chat inside at app.bullbitcoin.com and we will do the absolute best we can to help guide you. However, Bull Bitcoin is not a consulting service, our customer support chat is a free convenience and does not come with service guarantees. 

Option 1:

1. Download the BULL mobile wallet on your phone

2. Write down your seed words with this new wallet (make sure you have a copy of these words securely stored).

3. Send all the funds to the BULL mobile wallet immediately.

4. Your funds are no longer at risk from the Coldcard bug.

5. You can think about a permanent solution for cold storage of your Bitcoin later

Option 2:

1. Update your Coldcard’s firmware using these instructions: https://coldcard.com/docs/upgrade/

2. Select the “Advanced/Tools” menu option.

3. Select the “Temporary seed” option.

4. Select “Generate Words”

5. Select the “24 Dice Roll” option

6. Grab a pair of dice, and roll the dice 100 times. You will enter the number you get on the dice in the Coldcard device.

7. Once that is done, you will be asked to write down your seed words. Do that on a piece of paper, keep it secure.

8. You will be asked if you want to keep this seed in the Seed Vault. Click “Yes”.

9. On the homepage of your Coldcard, you will see the “Seed Vault” option. Make sure your new Seed is selected. You can rename it “Safe Wallet” to make it easier for you.

10. On the home page, you will see the "Passphrase" option. 

11. Enter a strong passphrase. It must be complex enough that it is very hard to remember. If you are not sure if your passphrase is strong enough, select 6 words randomly. Do not ask an AI to select the 6 words. If you are anxious, we find it helpful to pick the words randomly from this list: https://bip39-phrase.com/ 

12. Make sure you save the passphrase in a secure location, preferably separated from your seed, without it you won't be able to access your funds.

13. After entering this passphrase, you will enter a secure, randomly generated Coldcard wallet.

14. It’s extremely important to test recovery of the new wallet which has a passphrase, before moving any substantial funds to it. 

15. Once you have tested recovery and confirmed access to the new wallet, proceed to move the funds from the vulnerable wallet to the new, secure Coldcard wallet.

Act now, but do not rush. A panicked migration can lead to a loss.

If you're anxious, work with a professional.

And again: never ever let an AI generate or validate your passphrase.