Coldcard Exploit Exposes Millions of Bitcoin Owners to Cyber Threat

A security exploit has been discovered in Coldcard devices, hardware wallets from Canadian manufacturer Coinkite. The attackers managed to access private keys without any internet-based phishing or malware, instead exploiting a flaw in the wallet's entropy generation.

The issue was identified by Coinkite as a problem with their migration to libsecp256k1, which quietly rerouted seed generation away from Coldcard's own hardware random number generator. The company had defined the setting that controlled this change as zero, effectively disabling the safety check and allowing the build to complete.

This meant that older devices were using a pseudo-random number generator (PRNG) with a search space of only 40 bits, while newer models had around 72 bits. However, neither of these numbers is close to the target of 128 bits required for secure key generation.