Coldcard Hardware Wallet Flaw Exposed After Five-Year Lapse

A serious security flaw in the Coldcard hardware wallet has been exposed after it went undetected for five years, raising concerns about the lack of robust security verification systems in the cryptocurrency hardware wallet industry.

The flaw, which was introduced in March 2021 during the integration of a new cryptography library, led to the theft of about $90 million in Bitcoin from more than 4,500 addresses. Coinkite, the maker of Coldcard, halted all device shipments and destroyed all inventory loaded with the affected firmware after confirming the issue.

Nick Percoco, Kraken's Chief Security Officer, called the incident a 'wake-up call' for hardware wallet manufacturers, urging them to adopt an independent process to verify that approved random-number generation paths are actually running in shipping firmware. He noted that this kind of end-to-end verification is already standard elsewhere in the security industry.

Coinkite urged owners of affected devices not to discard them on their own, as the hardware could be needed later in any effort to recover funds.