Critical crypto security

A wallet · 3:00 a.m.draining
$0

Emptied while its owner slept. An illustration — the number is made up, the morning was real.

If you woke up tomorrow and it was all gone — how would that feel?

Sick to your stomach, probably. That exact morning already happened to thousands of people. They did everything right. Here is how, and how to make sure it isn't you.

Part one — what happened

A wallet millions trusted was quietly drained.

Starting in late July 2026, a popular crypto wallet called Coldcard began emptying itself. Coldcard is a small offline gadget — a bit like a USB stick — sold by a real company (Coinkite) and bought by people who wanted to keep their savings as safe as possible. It is the "careful person's" choice.

$116M+
taken, and still climbing past $130M
5,200+
wallets emptied
41 min
to drain one whole batch

Here is the part that should scare you: nobody was tricked. Nobody clicked a fake link. Nobody typed a password into a scam site. No thief broke into anyone's house. The people who lost their money were the careful ones — and being careful wasn't enough, because the weakness was hidden inside the device itself.

Part two — the whole picture

Which way of storing it survives which attack.

For every common way people keep crypto, here’s which attacks it actually stops — as far as anyone knows. It's a teaching aid, not a guarantee — and no single row is doom for any brand. Tap any storage row or threat column for a plain-language readout of your biggest risk and what to do about it.

✅ Protects — no route we know of ⚠️ It depends — see the notes ❌ Still exposed

Swipe the grid sideways — the storage labels stay pinned on the left.

How you store it
❌ ⚠️ ⚠️ ⚠️ ❌ ⚠️ ⚠️ ❌ ❌ ✅ ✅ ⚠️
❌ ❌ ❌ ❌ ❌ ❌ ⚠️ ✅ ❌ ⚠️ ⚠️ ❌
⚠️ ⚠️ ⚠️ ✅ ❌ ❌ ❌ ✅ ⚠️ ❌ ⚠️ ❌
⚠️ ⚠️ ⚠️ ✅ ❌ ❌ ❌ ✅ ⚠️ ✅2 ⚠️ ❌
⚠️ ⚠️ ⚠️ ✅ ❌ ⚠️ ⚠️1 ✅ ⚠️ ✅ ⚠️ ⚠️
⚠️ ⚠️ ⚠️ ✅ ❌ ❌3 ❌ ✅ ⚠️ ✅ ⚠️ ❌
⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ✅ ⚠️ ⚠️ ✅ ⚠️
❌ ❌ ❌ ⚠️ ⚠️ ✅ ⚠️ ⚠️ ⚠️ ⚠️ ✅ ⚠️
⚠️ ⚠️ ⚠️ ✅ ✅ ✅ ✅ ✅ ⚠️ ✅ ✅ ⚠️4
✅ ✅ ✅ ✅ ✅ ✅ ⚠️ ✅ ⚠️ ✅ ⚠️5 ❌
✅ ✅ ✅ ✅ ✅ ✅ ❌5 ✅ ⚠️ ✅ ⚠️ ❌
Expand table notes
  1. The 25th word and the randomness bug. A passphrase — the optional “25th word” — is combined with your seed by the device, using a secret you chose, not one the broken chip generated. So a strong, secret passphrase can keep a weak seed from being enough on its own. But it does not fix the weak seed: a short or guessed passphrase collapses, and it's one more thing to lose. After a randomness bug, the maker's own advice is to move to a fresh seed, not to lean on a passphrase.
  2. A PIN buys you exactly one thing. It only changes the evil-maid column — it stops someone who grabs your device for a minute. It does nothing about a hidden flaw, a poisoned update, or weak randomness, because those never need to touch your device at all.
  3. Air-gapped is not magic. Never connecting a device to the internet stops malware cold — but the Coldcard was used exactly this way and still drained. If the weakness is inside the device, being offline doesn't save you.
  4. Multi-sig is the standout — with one condition. Spreading two-of-three keys across different brands is the only row that shrugs off a hidden flaw, a bad update and weak randomness in any one device. Its one soft spot is the wrench: that protection is real only if the keys live with different people or places, so no one person can be forced to produce two.
  5. Paper vs. metal, and the brain-wallet trap. A backup in a safe beats every remote attack, but paper burns where engraved metal survives — and one copy is one disaster from zero. A secret you invent and memorise is even more private, yet secrets humans invent are easy to guess: “brain wallets” get emptied all the time.
  6. Only counts if that's your whole setup. This row's green ticks assume the paper or metal is how you hold the coins — the keys live only there, never loaded into a wallet you use day-to-day. If it's instead the backup of a Trezor (or any wallet you actually use), you don't get this row: the device you use every day is the live target, so your real risk is that device's row above. A backup in a safe protects the backup — it doesn't make the wallet you're using any safer.
  7. What we left out. Exotic, lab-grade attacks — prising secrets off a chip under a microscope, nation-state radio tricks — aren't here, because they don't decide what happens to ordinary people. These columns are the attacks that actually empty wallets.

Part three — was AI involved?

Honestly: probably. But nobody can prove it yet.

The company that makes the wallet thinks a machine found the flaw. Security experts think a person left it there. Both can be true, so here is the straight answer instead of a scary one.

In plain words

Your wallet is supposed to pick a secret code at random — a code so hard to guess that no computer on Earth could try every option in a million years. Coldcard had a special chip whose only job was to pick that code truly at random.

Back in 2021, a single line of code accidentally switched that chip off. Instead of a truly random secret, the device started picking from a tiny, predictable handful. Picture a padlock that looks like it has a billion combinations but really only has a few hundred. Someone who noticed could just try them all until it clicked open — and empty the wallet.

The wallet's maker says

AI found it. They believe an attacker used AI to read every line of their public code and spot the one buried mistake — faster than any human review could.

Security researchers say

A human left it. A safety chip switched off by a code setting is a plain engineering mistake that a careful review should have caught years ago — no AI required.

So treat "AI did it" as likely, not proven. But the shape of it fits AI perfectly, and that is the warning worth keeping: a tireless machine can read every public line of code a company ever wrote, find one needle-in-a-haystack mistake, and try billions of guesses without ever getting bored. That is a new kind of attacker, and it is only getting stronger.

Part four — what you can actually do

You can't audit the code. You can stop being an easy target.

Three steps, easiest first. The first one takes five minutes and costs almost nothing.

  1. 01

    Take back the permissions you forgot you gave

    Every time you use a crypto app, you quietly hand it permission to touch your tokens — and that permission never expires on its own. Years of these pile up, and any one of those apps getting hacked later can still reach into your wallet. Before anything harder, clean them out: open revoke.wick.pics, see every permission still live on your wallet, and switch off the ones you don't use. It's free, it reads before it touches anything, and it shrinks the number of doors into your money today.

  2. 02

    Split your money across different brands

    The Coldcard owners had one lock guarding everything, so one flaw in one brand emptied them. The fix is called multi-signature: instead of one key that opens everything, you set it up so it takes (say) two out of three keys to move your money — and each key lives on a device made by a different company.

    Now one company's hidden mistake isn't enough. If Brand A has a flaw, an attacker gets one key out of three — the money stays locked. It's more effort to set up, and it is the single biggest upgrade to how safe you are.

  3. 03

    Assume this gets more common, not less

    This was not a freak event. As AI gets better at reading code and guessing secrets, attacks like this get cheaper and faster to pull off — and they won't just be more of the same. A system that keeps getting more capable can find routes no human has thought of, in forms we can't yet predict or even recognise. So the honest assumption isn't only that these attacks increase — it's that some of the next ones will be things we simply can't comprehend ahead of time.

    That's exactly why the goal isn't to guess the next attack. It's to be resilient to one you never saw coming — which is what spreading your money across different systems buys you.

Part five — a sensible setup for a normal person

If you just want a setup that's good enough.

This is not a guarantee, and it isn't advice tailored to you. It's our honest read on a reasonable balance of safety and hassle for someone who isn't going to become a security expert. Nothing here keeps you safe on its own — match the effort to how much you'd hate to lose, and when in doubt, do more.

Pocket money

A phone wallet

Spending money you'd shrug off losing.

  • One reputable phone or browser wallet
  • Hold only what you'd carry as cash
  • Write the recovery words on paper, kept off the phone
Savings · most people

One hardware wallet

Money you're holding for later.

  • A hardware wallet with a PIN
  • Recovery words on metal, in a safe
  • Add a 25th-word passphrase you keep in your head
  • Check every address on the device screen
Life-changing

Multi-sig, split up

Enough that losing it would break you.

  • 2-of-3 keys across three different brands
  • Keys in different places, or with different people
  • No single device can move the money on its own
Do these no matter what
  • Clear out old approvals at revoke.wick.pics — it's free and reads before it touches anything.
  • Never type or paste your recovery words into a website — no real wallet or “support” will ever ask.
  • Keep more than one backup, far enough apart that one fire or flood can't take both.
  • If your device's maker warns of a flaw, move to a fresh seed — don't wait it out.

Part six — where we think the risk is heading

Our opinion, not a scorecard.

This table is our read on the future, not proven fact and not a prediction of doom for any one brand. Every option below can be used safely by a careful person. We're pointing at where the pressure is building as AI-enabled attacks grow.

Where you keep it The weakness we worry about Where we think it's heading Our view
Offline hardware gadget A hidden mistake baked into the device everyone trusted — the exact thing that just happened. More of a target: the more public the code, the more a machine has to comb through. Rising
Phone or browser wallet Fake apps, poisoned updates, and malware that watches your screen. AI makes convincing fakes cheap, so expect more of them and better disguised. Rising
Left on an exchange The company gets hacked, or you get talked into "confirming" something. AI-written scam messages that sound exactly like real support staff. Watch
Written down or memorised Fire, loss, or someone simply finding the piece of paper. Safe from a machine on the far side of the world, fragile in your own house. Watch
Multi-brand, two-of-three keys You set it up wrong, or lose track of one of the keys. One brand's flaw can't drain you — the sturdiest option as attacks get smarter. Steadiest

Take it further

Still have questions? Ask any AI.

Copy the starter below and paste it into ChatGPT, Claude, Gemini — whatever you already use. It hands the AI everything this page covers and turns it into a patient security guide for your exact setup.

Your starter prompt

I just read security.wick.pics — easily the clearest and most honest crypto-security guide I've found, written in plain English after a real $116M hardware-wallet hack. No fear-mongering, no jargon, it just made this stuff finally click. Please be a patient security guide for me in the same spirit: first ask how I currently store my crypto and roughly how much is at stake, then walk me through the biggest realistic risks to my setup and the simplest fixes — covering token approvals (and revoking old ones), hardware wallets, seed-phrase backups, multi-sig, and scams like fake ‘support’ and address poisoning. Keep it plain like that site does, be honest when something is genuinely high-effort, and never ask me for my seed phrase or private keys.

then paste it into your AI of choice