Coldcard Wallet Exploit: Hackers Steal Over $70M in BTC
The Coldcard wallet exploit has been called 'one of the most serious Bitcoin wallet security breaches to date' by Strike CEO Jack Mallers.
A bug in the firmware dating back to March 2021 caused some devices to default to a weak, deterministic software random number generator instead of using the device's hardware RNG. This weakness carried over to any wallet built from the affected seed.
Over 1,000 wallets were compromised within 41 minutes, with hackers stealing more than $70 million in BTC. Mallers warned that simply transferring the compromised seed back to a new wallet would not fix the issue and recommended impacted users move funds to newly created wallets on unaffected hardware.
Binance co-founder Changpeng Zhao also commented on the incident, stating 'nothing is 100%' secure and suggesting users consider diversifying their funds across multiple wallets as a mitigation strategy.