Coldcard Wallet Bug Exposes $130M in Bitcoin Losses

A bug in the Coinkite Coldcard wallet has exposed over $130 million worth of Bitcoin to theft, according to an investigation by Block's Bitcoin Engineering and Security team and independent developers. The flaw was found in firmware versions 4.0.1 through 4.1.9, which affected Mk2 and Mk3 devices, and produced seeds with a small, searchable set of output space.

The bug diverted the device's random-number generation from its STM32 hardware source to MicroPython's deterministic Yasmarang fallback, compromising the security of Bitcoin self-custody.

A firmware update is available, but affected users need to generate an entirely new seed and move their funds. Importing the old phrase into a different manufacturer's wallet carries the same weakness.