Coldcard Hack Exposes Risks of Hardware Wallets

A recent hack of Coldcard, a Canadian firm's bitcoin-only hardware wallet, has resulted in more than $100 million being swept from over 7,300 addresses. The exploit began on July 30 and continued through August 4, with at least 15 attackers exploiting the same five-year-old firmware flaw.

The issue was caused by a March 2021 firmware change that used a predictable software randomizer instead of the chip's hardware one for key generation, allowing attackers to reconstruct keys offline. Coinkite, the maker of Coldcard, has published the affected models and firmware versions.

A patch was released on July 31, but it cannot repair already-generated keys. Owners must create new ones and move their coins, with a minority of setups built with independent private entropy being exempt.