Coldcard Wallet Flaw Exposes $38M in Bitcoin to Simultaneous Theft

A major security flaw in the Coldcard wallet has led to the theft of $38 million worth of Bitcoin. The vulnerability, which affects devices manufactured between March 2021 and the latest firmware hotfix, allows attackers to compromise single-signature wallets with reduced entropy.

The attack occurred when over 500 wallets were drained simultaneously, with the funds being transferred to a consolidating address. Security researchers have identified the low-entropy seed generation vulnerability as the most plausible explanation for this incident.

CoinKite's technical advisory reveals that the flaw was caused by a build configuration and preprocessor check that failed to enforce the use of the hardware True Random Number Generator (TRNG). Instead, the software-based Pseudo-Random Number Generator (PRNG) from MicroPython was used, resulting in reduced entropy.

The affected devices include Coldcard Mk3, Mk4, Mk5, and Q models. The Coinkite advisory warns that updating firmware does not fix existing seeds, and users must generate a completely new seed on updated firmware to ensure security.