Coldcard Security Flaw Exposes Thousands of Wallets to Nearly $90 Million in Losses

A recent security flaw in Coldcard's hardware wallet has sparked calls for independent audits of firmware after nearly $90 million worth of Bitcoin was drained from thousands of wallets.

Kraken's chief security officer, Nick Percoco, said the incident should serve as a warning to the hardware wallet industry and argued that manufacturers should not be the only parties verifying how wallet seed phrases are generated.

Coinkite, the company behind Coldcard, revealed that the vulnerability dates back to March 2021 when it migrated part of its firmware. The updated firmware accidentally used a weaker deterministic pseudo-random generator instead of the intended hardware-backed true random number generator for generating wallet seeds.

The company has released fixed firmware but advised users to create new seed phrases because updates cannot repair existing wallets. Coinkite estimates that affected devices may contain about 40-72 bits of effective entropy, which is significantly less than the intended 128 bits.