Episode #195 – The Gap

Bitcoin is a machine for remembering, and it works because of one deliberate hole in its memory. The Coldcard entropy failure filled that hole with facts the world had already written down somewhere, which turned a private key into an explainable object and cost people hundreds of millions of dollars without a single server being breached. Entropy is the size of the gap in the record, and the episode works out why nothing else in the system can do its job.

Episode Summary

Bitcoin is a machine for remembering. Every block, every transaction, every satoshi that has ever moved is written down in public, the writing is permanent, and it is checkable by anybody with a laptop and a small amount of compute. Fifty years from now a payment made in 2011 from some random bedroom in Helsinki will still be auditable, which is the whole of the invention, with one deliberate exception. There is a single fact recorded nowhere: not in any block, not on any node, not in any of the government databases tracking the network. That fact is the private key, and it has to be that way, because a system that remembered absolutely everything would also give everything away. Anything fully written down is something somebody can work out. Bitcoin therefore needs exactly one hole in its memory, and that tiny hole is the only thing standing between a person’s coins and every other person on the planet. Entropy, throughout this episode, means the size of that hole and nothing more elaborate. What happened at Coldcard was not a breach in any conventional sense. No servers were compromised, no houses were entered, nobody was manipulated into handing over their words, and nobody was attacked with a wrench. The people who lost money had by any normal standard done almost everything right: they bought a well-supported hardware wallet, generated a seed on it, wrote the words down, and put them somewhere safe, some of them doing exactly that correctly for five years. The failure sat underneath all of it. The firmware defined the flag for the hardware random number generator as zero, meaning off, and the library that needed to know whether the hardware generator was available asked whether the setting existed rather than whether it was switched on. Zero exists. The check passed, on every device and every time, for five years, and seed generation fell back quietly to a deterministic software algorithm, a thing that produces numbers which look random and are in fact worked out completely in advance.

That fallback was seeded from three values, and what those three have in common carries the entire episode: each of them is already written down somewhere in the world. The chip’s serial number is stamped on the chip. The boot counter is a number the device itself is storing. The time is the single most publicly recorded fact in the universe, with every satellite, every phone, every exchange, and every one of us agreeing about it continuously and for free. A search space intended to run to at least 128 bits collapsed to roughly 40 bits on the older Mark 3 devices and something closer to 72 on the Mark 4 and later. Forty bits is not difficult. Seventy-two is expensive, and expensive is relative when hundreds of millions of dollars sit on the other side of the calculation. The seeds had come to remember their own birth: made on chip number such-and-such, at this time, after this many boots. A key that carries memory is a broken key, and in the entire history of this technology that has always been the failure. Nothing about the seed’s appearance changed, which is why the problem sat undisturbed for five years. It was the same twelve or twenty-four words, the same length in bits, the same gibberish on inspection, and it restored perfectly. Handed the word list, nobody could tell by looking whether it came off dice rolls or off broken firmware, and there is no test that can be run on the words themselves.