How I Lost $1.6 Million in Bitcoin in 8 Minutes

On July 31, Toronto-based entrepreneur and personal trainer Jonathan Goodman, 40, discovered that he’d lost $1.6 million in a major Bitcoin hack. The thieves targeted offline-password devices made by the Canadian company Coinkite and stole roughly $140 million worth of Bitcoin across 7,300 accounts. Goodman, author of Unhinged Habits, spoke with TLDR’s Jenna Benchetrit about the experience.

***

I grew up in a middle-class Jewish family in Canada. My dad’s an engineer, and my mom’s a teacher. My relationship to money growing up was: you’re a professional, you have a salary, you invest it prudently, and you can be reasonably assured that you’re going to be taken care of.

I first looked at crypto in 2017, after my personal-training business had taken off. But the risk profile wasn’t what I was looking for, so I didn’t buy any. A few years later, it seemed like the risks had evolved enough that it made sense to buy, so I started putting 10% to 15% of my company’s excess profits into Bitcoin. Over a year and a half, I put in over a million dollars, and my holdings grew to $3 million at one point.

Around this time, I bought a hardware device called a Coldcard wallet, made by Coinkite. It generated and stored a complicated offline password that I used to access my Bitcoin on the public digital ledger. That kept my Bitcoin safe, in theory, because you would need the physical hardware to access the password.  

Jump ahead to this July, and I was in a public library with my wife and kids when I saw a Facebook post from a friend who’s a big Bitcoin guy. The post basically was like: there’s been a hack, so if you use a Coldcard wallet, move your money immediately. 

I thought, There’s no way this affects me, but I’ll just check. I hadn’t looked at my accounts in a while; I never paid attention to the ups and downs in the crypto market, because my philosophy was that this was a long-term bet. But when my account loaded, I saw the red lines, and I knew that everything was gone. It had happened over eight minutes two days earlier. 

My wife and I went for a walk and processed it, then I got to work creating a digital paper trail. I sent a message to Coinkite right away. I sent a message to my financial advisor and accountants to tell them what happened. We were out of town at the time, so I decided that night that I needed to go back to Toronto and file a police report.

Talking to the police was a funny experience. They were like, “Oh, did somebody get into your safe-deposit box?” I had to explain that Bitcoin exists on a digital ledger and that to access that ledger, you need a password that is supposedly impossible to crack.

What I did not know was that a vulnerability in the device’s code made the password much less random than it should have been. A group of hackers was able to guess the password millions of times, at scale, until they cracked it. A lot of the early reports said that AI was likely used to identify the code vulnerability. Whether that’s true, I have no idea. For me, the scariest part is no one even knows where these people are in the world.

One reason I haven’t jumped off a cliff is because I invested in Bitcoin knowing that it could go to zero — though, of course, I didn’t think it would happen like this. Fortunately, none of this was money that my family depended on; it was literally locked away for my kids in the distant future.

One thing I’ve been thinking about is that Usain Bolt ate over a thousand chicken nuggets during the 2008 Beijing Olympics, which sounds insane. But he did it because he was afraid that the food in China would upset his stomach, and the only thing that could stop him from winning was getting sick. I like that story because that’s basically my financial philosophy: eliminating the smallest amount of catastrophic risk is often worth sacrificing some of the upside. And I don’t think that’s changed. But am I going to buy Bitcoin again? Probably not.