Coldcard Wallet Exploit Steals $88 Million Worth of BTC
A vulnerability in Coldcard wallets has led to the theft of 1,367 BTC, valued at approximately $88.6 million. The exploit stems from a firmware update in March 2021 that left users' seed phrases exposed to attackers who can predict them.
The issue arose because Coldcard devices used weak randomness for seed phrases, allowing attackers to reconstruct them and access funds. This flaw has resulted in three waves of attacks, with the latest wave alone capturing 207 BTC.
The vulnerability affects Coldcard models Mk2 through Mk5, and users are urged to generate new seeds on updated firmware or switch to different hardware. Security experts warn that even moving funds from affected wallets is risky, as attackers could intercept transactions with higher fees, taking the coins mid-transfer.