Coinkite Coldcard Hack Exposes Millions of Dollars in Bitcoin Losses

Coinkite's Coldcard devices have been compromised in a significant hack, resulting in an estimated loss of $130 million worth of Bitcoin. According to Galaxy Research and Lookonchain, over 7,700 victim addresses have been affected by the issue.

The problem stems from a seed-generation flaw in the devices' firmware, which allowed attackers to derive candidate keys offline when they could determine or sufficiently constrain relevant device information.

As reported, the March 2021 firmware integration error caused seed generation to route through a deterministic software pseudorandom number generator (PRNG) rather than the STM32 hardware random number generator (RNG).