Coldcard Wallet Exploit Drains Over $100M in Bitcoin

A security exploit is affecting Coldcard wallets, allowing attackers to drain Bitcoin from affected addresses. At least 15 separate attackers are involved in draining over $100 million in BTC.

Galaxy Research tracks the total amount stolen at over 1,596 BTC, with the potential for an additional wave bringing the total to around $130 million. The attacks started with a suspected silent change to the random number generator on March 31, 2021.

The vulnerability was acknowledged by Coinkite on July 31, and emergency firmware has been shipped to affected models. However, installing the update does not repair seeds already created.