Coldcard Firmware Flaw Exposes $38 Million in Bitcoin

A critical firmware flaw in Coldcard hardware wallets made by Coinkite has led to the theft of $38 million worth of Bitcoin from approximately 500 single-signature wallets. The vulnerability, discovered by Block's security and Bitcoin engineering teams, stems from a macro error in Coldcard's firmware that allows wallet generation to fall back to MicroPython's Yasmarang software generator.

The affected devices are Mk2 and Mk3 running firmware version 4.0.0 through 5.0.3, which have no cryptographic entropy added to the random number generator during key creation. Coinkite's own products Tapsigner, Opendime, and Satscard use different codebases and are not affected.

Users who added a strong BIP-39 passphrase or used at least 50 independent dice rolls during seed creation face substantially reduced risk. Those who did not should treat their seeds as potentially compromised and consider moving funds to a new wallet that does not rely on affected hardware.