Coldcard Hack Exposes Vulnerability in Bitcoin Self-Custody

A major security breach in Coldcard hardware wallets has raised fresh concerns about Bitcoin self-custody after hackers exploited a flaw in wallet's recovery seed generation process.

The attack, which occurred across four consecutive waves, impacted over 5,200 Bitcoin addresses and resulted in the theft of around 1,816 BTC worth nearly $116 million.

The vulnerability was linked to a 2021 firmware update that weakened the randomness used to generate recovery seed phrases, making some phrases predictable enough for attackers to reconstruct them using brute-force techniques.

The hackers did not need physical access to the Coldcard devices and could access and drain the wallets remotely once they recreated the vulnerable seed phrases.

The incident has sparked a debate on the increasing importance of artificial intelligence in cybersecurity, with some experts arguing that AI-powered code reviews are more effective at discovering vulnerabilities than manual audits.