Coldcard Firmware Flaw Compromises Over 1,000 Bitcoin Wallets

A devastating firmware flaw in Coldcard Mk3 devices has left over 1,000 Bitcoin wallets vulnerable to attack. The vulnerability, which affected wallets created between March 2021 and July 30, 2026, allowed attackers to drain approximately $70 million from the compromised accounts.

The issue lies in the random number generation process used by Coldcard Mk3 devices to build recovery seeds. Since these seeds were not truly random, attackers could exploit this flaw to drain funds from affected wallets.

Coinkite, the manufacturer behind Coldcard, has released a patched firmware version (4.2.0 and above) and a security advisory. However, users need to generate entirely new seeds on patched hardware and move their assets to those new addresses before considering themselves safe.

Binance's CZ has warned users to split their funds across multiple wallets in response to the exploit.