Coldcard Hackers Drain Over $130 Million as Firmware Bug Exposed

A firmware bug in Coldcard wallets allowed hackers to steal over $130 million worth of Bitcoin. The bug meant that seeds were generated from a software pseudo-random generator instead of the hardware chip designed for the task, reducing the search space from 128 bits to around 40 on older models.

This made it possible for attackers to guess private keys and drain funds from wallets that should have been secure. Coinkite estimates that at least 15 separate attackers have targeted Coldcard users, with over 1,596 BTC stolen across three confirmed waves, and a suspected fourth wave that would bring the total to around 2,055 BTC.

The bug was caused by a build guard using #ifndef, which checks if a setting exists rather than whether it's switched on. Coinkite had defined this setting as zero, meaning 'off', but since zero still counts as defined, the safety check passed and the build completed.