Coldcard Hack Exposes Millions of Dollars in Bitcoin

A major hack has affected users of Coldcard hardware wallets, resulting in over $70 million in Bitcoin stolen from affected addresses. The issue stems from a bug that caused seed generation to fall back to a weak software PRNG instead of the hardware true random number generator, producing seeds with only ~40 bits of entropy rather than the intended 128.

This made private keys for many single-signature wallets (especially those created without dice rolls or a strong BIP-39 passphrase) predictable enough for attackers to brute-force. A total of 594.5 Bitcoins worth over $35.7 million at today's prices were moved to a new address from single-signature addresses on Thursday.

Coinkite, the company behind Coldcard, has advised users to move their funds and has issued guidance for affected users. The hack has also highlighted concerns about the security of hardware wallets, with some experts warning that all users should consider switching to a different wallet to ensure the safety of their funds.