$70 Million Bitcoin Heist Exposes Flaw in Coldcard Wallets

A recent attack on Coldcard wallets drained over $70 million from nearly 1,200 devices in just 41 minutes. The heist occurred on July 30, with the attacker targeting wallets that used certain firmware versions. Researchers say a flaw in the hardware wallet's seed phrase generation allowed attackers to rebuild private keys without touching the devices.

The vulnerability affected older Mk2 and Mk3 models of Coldcard, but newer versions were not impacted. The attack is significant because it demonstrates how an attacker can reconstruct private keys using computational power, making it possible to drain funds from wallets without ever accessing them directly.

The researchers note that the owner cannot reliably determine if their seed was generated on vulnerable firmware, leaving many users uncertain about their security. Coinkite, the maker of Coldcard, has warned owners of affected devices and is working to resolve the issue.