Coldcard Flaw Exposes Millions in Bitcoin

A five-year-old firmware flaw in Coldcard bitcoin wallets has led to estimated losses of over $100 million. The attack, which has been ongoing since July 30, was traced back to a code change made on March 1, 2021, that switched the device's hardware random-number generator to a software-based one.

This change reduced the number of possible seed combinations from 256 bits to approximately 40 bits, making them easier to predict. As a result, thieves were able to drain millions in Bitcoin from nearly 1,200 addresses in less than an hour on July 30.

Coinkite, the Canadian manufacturer of Coldcard wallets, released emergency firmware updates and advised users who created wallets with affected firmware versions to move their funds to new wallets generated with secure recovery seeds.