Coldcard Wallet Bug Exposes Millions in Bitcoin

A critical bug in Coldcard wallet products has led to the theft of over $70 million worth of Bitcoin, according to recent reports. The issue affects Coldcard Mk3 devices, which were first affected in March 2021 with firmware version 4.0.1.

The problem lies in a faulty entropy mechanism that fails to use true randomness when generating wallet seeds, instead relying on a weak software-based pseudo-random number generator (PRNG).

This has made it possible for hackers to brute-force private keys and gain access to Bitcoin funds stored in the affected wallets. As of now, over 1,082 Bitcoins have been stolen from users who generated their seed phrases using insufficient entropy.

Coinkite, the company behind Coldcard, has acknowledged the issue and advised users to take precautions to secure their funds. The company has also released updated firmware versions for affected devices, but experts warn that users should consider completely ditching the wallet to ensure their Bitcoin is safe.