$111 Million Bitcoin Heist Exposed: Coldcard Firmware Flaw Revealed

A critical firmware vulnerability in Coldcard Mk3 devices has led to a massive $111 million Bitcoin theft, with a median loss of over one BTC per user. The flaw, which was present in devices produced by Coinkite since March 2021, enabled attackers to predict investors' seedphrases and seize their funds. Galaxy Research analyzed 250 reports and found that the majority of stolen coins had remained dormant for extended periods, with 88% of affected wallets untouched for at least a year.

The typical compromised coin was inactive for 3.5 years, and analysis revealed median losses ranging from 0.014 BTC to an average of 0.212 BTC per user. On a per-victim basis, the average loss was 1.022 BTC, with one reported case involving 58.97 BTC.

Coinkite acknowledged that the software flaw went 'silently unnoticed,' and advised users to update their software or withdraw funds from affected hardware wallets.