Your keys, not your crypto. A 330K lesson for all.

I was orange pilled back in 2021 and I was stacking hard ever since. I had managed to accumulate 5,13 BTC, something I was very proud of. Not so much for myself, but for the future of my daughter. And that's the only thought that brings me to tears, that one day handing 5+ BTC to my daughter is not gonna happen. I was stacking in all ways possible, mining, salary percentage straight to auto-accumulate, end of year bonus --> BTC, family gifts --> BTC. I even took a loan against by 401K a few months back. You can say my mouth was where my money was. I was so "proud" thinking that I only have a house loan at the bank. But everything was stolen today due to the coldcard exploit and the thing is that it seems to me this is how it was supposed to happen.

I had created a new seed using an MK3 that funny enough my orange piller bought me as a Christmas gift in December of 2021. I had some BTC at the time, maybe ~1 in other wallets and I thought it would be safer to safeguard them with a coldcard. Over the years I kept accumulating and sending over to my coldcard addresses. I only signed a TX once to make sure it works and a small gift to my mom.

When I created the new seed, I split into two parts and marked it on two steel plates. I had one part of the seed with me in the US and one in my home country. I also had two MK3, one with me, one back home. Both of them are time locked because wrench attacks lol. About a month ago, I decided it would be safer to store the second part of the seed in a bank vault back home and I did that. The vault could be accessed by myself and my father.

However, my father was diagnosed with cancer 2 weeks ago and has been hospitalized ever since. His operation was supposed to happen last week but he was not ready and it is rescheduled for this Thursday. So instead of coming back to visit on Tuesday as it was originally planned I flew out on Friday night.

Thursday night I saw the security notice and I immediately called my brother to get my coldcard, power it on and get the timer working backwards. With my father in the hospital and me in the US, there was no way of getting into the vault. I also tried with claude/codex/glm to beat the attackers by basically hacking my private key first as maybe knowing the first half of the seed or XPUB could help. As you can imagine, that didn't happen. Claude however did set up a live monitor on the mempool I run on my computer for on-chain analytics because wasting money was not enough. For 48 hours I did not get a message and I had a glimmer of hope. Last night however I could not sleep and I was thinking that maybe if I call enough people someone could be able to help me get to the vault on a Sunday. Unlikely but I had to try.

At 7am I got the telegram notification and that shattered me. But not just that, it made me feel shameful for what happened to me. I also felt as lonely as ever being away from my wife and daughter. I wish I could be with them.

Up until 3 days ago I thought I had done everything right. And yes some people will say but you didn't roll a dice, why you didn't use a passphrase, why not split it in 5 wallets. I didn't and frankly speaking I shouldn't have to and maybe that could also lead to other vulnerabilities (roll the dice but coldcard is like meh, i am just gonna use the python library instead). My biggest mistake was placing trust in a 3rd party. Which again is a rabbit hole on its own. In society we trust 3rd parties for basically everything, food, water, cars, airplanes, the list is endless.

The saddest part however is that when I visited my father today I couldn't be there for him. I just didn't have the strength. I put a brave face on but inside I was empty. This is my first and probably last post, I just want to share with the world what happened, forget about it and put on my big boy pants tomorrow for my family. Today I saw online a new term, aura farming and if there is such a thing, yes I want all the aura farm I can get. Not for myself but for my father. Wish us luck!

Update 1:

I am keeping the above draft version as originally written. Today is the second day and I am at the 'feeling angry' step of grief. Angry mostly at myself but also a bit towards the community. Don't take me wrong, I take full responsibility. However, what happened shook me to the core and made me rethink everything. First of all I realized that no one knows anything including myself. I was also appalled by some of the responses by other bitcoiners:

- You didn't roll a dice, what did you expect? No passphrase? What were you even thinking? No seal of blood on your entropy generation? Pfff
- Last bull run started after the FTX crash, LFG!
- Nothing stops this train, whatever ever doesn't kill us makes us stronger
- Hardware wallets are a marketing scam
- We will get through this together. (be honest, we are not)

I am not gonna say much on the above, but two things: What I saw the last 3 days is no longer a community that represents me and also guys.. read the room. People lost everything and years of effort just vanished. Personally, I didn't just lose my safety net, I think a part of me died yesterday. I don't even know if I want to be in crypto or do anything with btc any more. What two days ago seemed like a life mission today seems like a very foolish action.

There are a few thoughts I would like to share, both for the victims and the rest of the holders. Theoretically speaking, it takes a billion years to crack a 24 seed phrase so if you are thinking why I didn't use a passphrase or roll the dice, don't beat yourself up. Even today I don't think I needed more than 1 billion years of compute power protection to also add a passphrase. Yes I had one seed phrase but two Mk3, split seed and timelocks on devices. In theory I should be okay. But what I really had was 1.5 words of seed phrase. And here is what everyone needs to start reconsidering. Coldcard was open source, the bug was there for 5 years. People who were sworn by it, either never read the code or didn't have the ability to understand it. So open source is simply a false sense of security. People claiming that rolling the dice would have saved you, might be true for the specific exploit. It doesn't mean there isn't a wallet out there that took your randomly generated perfectly created dice outcome and did nothing with it. That is another false sense of security. People claim that multisig is the way, but that comes with its own challenges and risks. Suddenly everyone is an expert on the topic but where was everyone 1 week ago educating and screaming about any of this?

Which brings me back to my challenge everything state of mind. Some of my favorite slogans in the space:

1. Not your keys, not your crypto
2. Get your BTC off the exchanges
3. Sell your kidney if you must
4. You can never have enough bitcoin

Hadn't this happened I would have probably tattooed those phrases on my chest. But today I am rethinking.. why? Why wasn't 1 BTC or 2 BTC or 3 BTC enough for me? Suddenly, having cash in the bank seems like a good deal. 3rd party custody with a regulated exchange? Awesome! S&P500? Even better! Real estate? Best thing ever. I got greedy and with greed comes hubris.

Take it from someone who went all in and thought he had everything figured out and covered. Reconsider everything, how you store your coins, your investments, your diversification, everything. When FTX happened I was not directly affected, I just felt the market pain. I was naive thinking, well this is why I self custody, this won't happen to me. If you saw the coldcard exploit and thought this won't happen to me, please think again. BTC even today feels like the best risk/reward investment one could enter but the chances of going to 0 because an AI in 5 years will figure out something no one has so far, are not 0.

So maybe I won't give my daughter 5BTC, what I can give her today is time, love and attention and those are irreplaceable. I might get back to 5BTC one day (who am I kidding) but you never get back lost time. Seeing my father suffering today just brought me back to reality. It was just numbers on the screen, surely the screen now reads 0 but I still have my loved ones around.

Seize the day and don't trust anyone, even yourself.