Coldcard Firmware Flaw Exposed $88.6M in Bitcoin Losses Through Predictable Entropy

A critical firmware flaw in Coldcard devices has been linked to significant losses in Bitcoin, ranging from $38 million to $88.6 million. The bug, which affected Mk3 units running firmware versions 4.0.1 through 4.1.9, reduced seed entropy from 128 bits to as low as 40 bits.

This means that private keys on affected devices were exposed to brute-force attacks, compromising the security of users who relied on Coldcard for secure storage.

The vulnerability was discovered through AI-powered code-auditing tools, which are capable of scanning open-source firmware and flagging exploitable entropy patterns faster than human audit teams.

Coinkite, the maker of Coldcard, has released patched firmware to address the issue, but users who generated seeds on affected devices must update to the new version and generate a completely new seed.