Coldcard Flaw Exposes Thousands of Bitcoin Wallets to Predictable Seed Phrases

A significant security incident involving Coldcard hardware wallets has led to the loss of approximately 594 BTC, valued at around $38 million. The attack occurred between 01:31 and 01:56 UTC on July 31, with an attacker sweeping funds from over 500 separate Bitcoin wallets in just 25 minutes.

The affected wallets were all single-signature, had been dormant for years, and were created between 2021 and 2026. The investigation revealed that the flaw was due to a build setting that instructed the device to skip its hardware randomness generator, resulting in predictable seed phrases.

CoinKite, the company behind Coldcard, has confirmed that Mk3 devices with firmware 4.0.1 or later are affected. Users are urged to move their funds and generate a fresh wallet on a trusted device. The incident highlights the importance of security and the need for multi-signature setups.