Coldcard Flaw Exposes $88.6M in Bitcoin to Thief

Coldcard wallets are designed for serious Bitcoin users who want to keep their funds secure offline. However, in March 2021, a hidden flaw in the device's software led to an $88.6 million Bitcoin theft.

The issue arose because some Coldcard devices started generating customers' private keys using their serial number and internal clock instead of a dedicated chip designed for random number generation. This made the keys easier to predict.

An attacker took advantage of this vulnerability, stealing 594 Bitcoins from approximately 500 inactive wallets in just 25 minutes on July 30. The thief's actions were linked to 1,082 Bitcoin across 1,196 addresses by August 2, with a total value of nearly $88.6 million.

Coldcard's software code is publicly available, as well as information on the Bitcoin blockchain. The attacker spent several weeks figuring out possible keys generated by the faulty software, which could then be matched with Bitcoin addresses holding funds.