Coldcard Wallet Flaw Exposes Users to Predictable Private Key Generation

A hardware wallet called Coldcard has been compromised due to a predictable private key generation flaw.

The issue, which began in March 2021, affected certain units of the device by relying on the serial number and internal clock instead of the specialized chip for generating random numbers. This made the keys easier to anticipate.

A hacker exploited this vulnerability between July 30 and August 2, stealing nearly 1,367 Bitcoin valued at around $88.6 million from roughly 500 dormant wallets within a 25-minute window. Galaxy Research connected the broader theft to 1,082 Bitcoin spread across 1,196 addresses.

The attacker required no physical access to the wallets and seemingly invested several weeks in figuring out the potential keys that the flawed software might have generated. Those keys could then be matched against Bitcoin addresses containing funds.