Coldcard Wallet Hackers Drain Over $144 Million in Bitcoin
A security flaw in the Coldcard Bitcoin hardware wallet has enabled thieves to steal over $144 million from approximately 7,300 wallets. Researchers at Galaxy Digital first noticed the initial heist on July 30th, which lasted for a 41-minute window. The vulnerability allowed hackers to siphon funds without needing physical access to the victims' devices.
The bug was caused by a misconfiguration in Coldcard devices that resulted in them skipping their own hardware randomness generator. This meant that impacted devices fell back to a more deterministic, software-based random number generator. Attackers were able to infer the outputs of this feature and drain funds from affected wallets.
Coldcard's CEO Rodolfo Novak apologized for the incident, stating 'I'm sorry and I'm devastated.' The company has since released a firmware update to fix the issue, but those who are impacted will still need to repair their affected 'seed.'