$75M Coldcard Hack Exposes Thousands of Bitcoin Wallets

A security breach in Coldcard hardware wallets has left at least $75.1 million worth of Bitcoin exposed, according to Galaxy Research.

The attack, which affected Mk2 and Mk3 devices running firmware versions 4.0.1 through 4.1.9, is believed to have been carried out by a single attacker who never physically accessed the wallets.

The flaw in the firmware caused the device to fall back to a software-based random number generator instead of a hardware one, reducing the entropy from 128 bits to around 40 bits.

This allowed the attacker to regenerate the likely seeds offline and derive the corresponding addresses, which were then used to drain funds from over 2,600 wallets in a 41-minute window on July 30.