Coldcard Wallet Breach Drains Over $130M in Bitcoin

The Coldcard wallet breach has drained over $130 million in Bitcoin from more than 7,300 devices. A firmware flaw introduced in March 2021 compromised the security of these wallets by reducing their cryptographic key strength to just 40 bits.

The vulnerability was discovered when researchers found that seed phrase generation on affected devices relied on a predictable software randomizer instead of the device's dedicated hardware randomness chip.

The breach occurred in multiple waves, with attackers draining cryptocurrency from wallets holding small and large amounts. The stolen funds have been routed through privacy protocols such as Wasabi and Tornado Cash, making it harder to track the money.