Coldcard Hardware Wallets Patch Critical Vulnerability After $112 Million in Stolen Bitcoin

A critical vulnerability in Coldcard hardware wallets has been tied to over $112 million in stolen Bitcoin, highlighting the importance of security updates and customer vigilance.

The issue, which Coinkite revealed in a blog post on August 20, relates to seed phrase generation. Until now, users could create new seeds by simply pressing buttons at random intervals. However, attackers could exploit this predictable pattern to reconstruct private keys and steal funds.

Coinkite's fix involves introducing physical randomness into the seed creation process. New firmware updates require a minimum of 65 key presses, 50 rolls of a six-sided die, or 128 coin flips combined with device entropy.

The patch does not retroactively secure existing seeds created on affected firmware versions. Affected users must create new seeds and migrate their funds to avoid further losses.