Coldcard Heist Exposes Deep Flaw in Bitcoin Wallet Software

A series of high-profile Bitcoin heists has left the cryptocurrency community reeling. The latest attack, which drained over $70 million from Coldcard wallets, is believed to have exploited a firmware bug in the device's software. According to engineers at Coinkite, the issue began with version 4.0.1 of the Coldcard Mk3 devices in March 2021.

The bug allowed attackers to predict private keys for single-signature wallets, particularly those created without dice rolls or a strong BIP-39 passphrase. This weakness was reportedly exploited by thieves who used a top blockchain services provider to query source addresses and perform other related activities during the sweeps.

Galaxy Digital's research arm noted an unusual pattern of coin movements, which confirmed that all the stolen funds came from the same attacker. The company warned Bitcoiners to move their funds out of single-signature Coldcard addresses and into secure custody.