Coldcard Updates Firmware After $130 Million Bitcoin Heist
Coldcard, maker of hardware wallets, has released an updated firmware to address a security flaw that allowed attackers to steal more than $100 million in Bitcoin. The company identified a seed-generation issue that made it easier for hackers to guess private keys, allowing them to drain wallets of their funds.
The attack, which began in July and was tracked by Galaxy Research, resulted in the theft of approximately 1,778 BTC, worth around $112 million at the time. By August 14, the total stolen had surpassed $130 million, making it one of the largest Bitcoin heists to date.
Coldcard has released firmware 5.6.1 or 1.5.1Q for users to upgrade and fix the issue. The update adds new security measures, including requiring at least 65 key presses, 50 dice rolls, or 128 coin flips to generate a wallet seed, as well as replacing the Yasmarang backup pseudo-random number generator with SHA-256 Hash_DRBG.