Coldcard Cracks Down on Security Flaws After $130 Million Bitcoin Heist

Coldcard has released new security measures after attackers exploited a seed-generation flaw in its Bitcoin hardware wallets, resulting in over $130 million in stolen BTC.

The company, Coinkite, rolled out firmware updates for Coldcard Mk4, Mk5, and Q users to address vulnerabilities related to transaction signing, USB connections, backups, and wallet functions.

Coinkite also introduced a new requirement for users to add randomness when generating new seeds using at least 65 key presses, 50 dice rolls, or 128 coin flips, which the device combines with its own randomness.

The seed-generation flaw allowed attackers to steal an estimated $130 million in Bitcoin from air-gapped Coldcard wallets. Coinkite suggested that the attackers may have used AI to uncover the flaw after examining older versions of its open-source firmware.

Coldcard's security overhaul also includes checks for partially signed Bitcoin transactions, tightened USB data access, hardened Delta Mode, and improved wallet backup handling.