Coldcard Wallet Theft Exposes Weak Seed Randomness, Raises Security Concerns

A recent Coldcard wallet theft has exposed weak seed randomness in multiple Coldcard models, raising concerns about the security of affected users' funds.

The attack, which occurred within a 25-minute timeframe, drained approximately $38 million worth of Bitcoin from around 500 wallets. The stolen coins were transferred through hundreds of transactions in a narrow three-block window, with roughly 562 BTC eventually reaching one address.

An investigation by researchers linked the losses to a Coldcard firmware flaw that weakened seed creation randomness during the exposure period between 2021 and 2026. The affected seeds cannot be repaired, but users can create new ones after updating their firmware.