Coldcard Wallet Hack Exposes Vulnerability in Hardware Security

A serious security breach has affected Bitcoin users who rely on Coldcard wallets. Strike CEO Jack Mallers called it 'one of the most serious' incidents to date.

The issue stems from a firmware bug discovered by Block's engineering team, which went back to March 2021. The bug caused the wallet seeds to be generated using a weak software random number generator instead of the hardware one on the device.

This means that any wallets created with these compromised seeds are vulnerable to attacks. Mallers warned that simply moving the compromised seed to a new wallet won't fix the issue, as the problem lies in how the seed was generated.

The hack resulted in 1,196 addresses being swept for 1,082.65 BTC (around $70.2 million) within a 41-minute window on Thursday. Binance co-founder Changpeng Zhao noted that even hardware wallets can have bugs and suggested diversifying funds across multiple wallets as a mitigation.