Coldcard Wallet Breach Exposes $130M Vulnerability

The Coldcard wallet breach has exposed a vulnerability in the firmware of over 7,300 devices, resulting in the theft of more than $130 million in Bitcoin. The problem dates back to March 2021 when a firmware build was released that routed seed phrase generation through a predictable software randomizer instead of the device's dedicated hardware randomness chip.

This weakness left a limited, guessable pool of possible keys, making brute-force cracking of affected wallets feasible for attackers with enough computing power. The breach has unfolded in three documented attack waves, with evidence pointing to a possible fourth wave still underway.

The stolen funds have been routed through privacy tools such as Wasabi and Tornado Cash, making it harder for investigators to track the money's final destination. Security experts warn that simply updating firmware provides insufficient protection for those who already initialized a wallet on an affected device.