{"id":18268,"date":"2026-08-02T07:56:56","date_gmt":"2026-08-02T14:56:56","guid":{"rendered":"https:\/\/jasonsblog.ddns.net\/?p=18268"},"modified":"2026-08-02T07:56:56","modified_gmt":"2026-08-02T14:56:56","slug":"emergency-turn-off-rbf-stop-some-coldcard-users-getting-robbed","status":"publish","type":"post","link":"https:\/\/jasonsblog.ddns.net\/index.php\/2026\/08\/02\/emergency-turn-off-rbf-stop-some-coldcard-users-getting-robbed\/","title":{"rendered":"Emergency: Turn Off RBF &#8211; Stop Some Coldcard Users Getting Robbed"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">If you&#8217;re running your own <a href=\"https:\/\/jasonsblog.ddns.net\/index.php\/2025\/09\/12\/the-case-for-the-only-cryptocurrency-of-value-bitcoin\/\" target=\"_blank\" rel=\"noreferrer noopener\">Bitcoin<\/a> node, you can turn off Replace By Fee, RBF, temporarily to prevent those with multisig wallets getting robbed by RBF transactions once they post transactions to the mempool to clear out their Coldcard hardware wallets. I&#8217;m not sure there will be enough of us, but perhaps enough of a time delay might help someone. The losses seem to have slowed, so hopefully most of those affected have gotten their Bitcoin out to something more secure. The last total I saw was $89 million stolen from Coldcard hardware wallets. This <a href=\"https:\/\/jasonsblog.ddns.net\/index.php\/2026\/07\/31\/security-advisory-all-coldcard-hardware-wallets-update-firmware-generate-new-seed\/\" target=\"_blank\" rel=\"noreferrer noopener\">post<\/a> has the technical details on the random number generator bug they introduced through faulty programming with how to update the firmware which fixed it. This <a href=\"https:\/\/jasonsblog.ddns.net\/index.php\/2026\/08\/01\/bitcoin-mechanic-on-the-coldcard-scandal-and-nvk\/\" target=\"_blank\" rel=\"noreferrer noopener\">post<\/a> gives history on Rodolfo Novak, NVK, and why I never really trusted the device for serious hodling of Bitcoin, though I have the Coldcard Q and still keep a few hundred dollars worth of Bitcoin on it for experimentation, new seed and firmware. <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Set to 0 to disable RBF entirely, \"fee,optin\" to honour RBF opt-out\n# signal, or \"fee,-optin\" to always RBF aka full RBF (default:\n# fee,optin)\n#mempoolreplacement=0<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Emergency: Turn Off RBF - Stop Some Coldcard Users Getting Robbed\" width=\"1290\" height=\"726\" src=\"https:\/\/www.youtube.com\/embed\/NAzqKxKcmlk?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>If you&#8217;re running your own Bitcoin node, you can turn off Replace By Fee, RBF, temporarily to prevent those with multisig wallets getting robbed by RBF transactions once they post transactions to the mempool to clear out their Coldcard hardware wallets. I&#8217;m not sure there will be enough of us, but perhaps enough of a [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-18268","post","type-post","status-publish","format-standard","hentry","category-tech"],"blocksy_meta":[],"featured_image_src":null,"author_info":{"display_name":"Jason","author_link":"https:\/\/jasonsblog.ddns.net\/index.php\/author\/jturning\/"},"_links":{"self":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/18268","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/comments?post=18268"}],"version-history":[{"count":1,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/18268\/revisions"}],"predecessor-version":[{"id":18273,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/18268\/revisions\/18273"}],"wp:attachment":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/media?parent=18268"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/categories?post=18268"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/tags?post=18268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}