Coldcard Wallets Compromised: 1,000+ Users Left Vulnerable to Theft

A recent security breach involving over 1,000 Coldcard Bitcoin wallets has left users vulnerable to theft, highlighting a significant hardware wallet compromise. Researchers estimate that 1,082.65 BTC was stolen from 1,196 wallets in just 41 minutes on July 30.

The attack targeted the wallet creation process itself, exploiting a firmware bug introduced in March 2021 that caused affected Coldcard Mk3 devices to generate recovery seed phrases using predictable software-based randomness instead of secure hardware random number generators.

Attackers could mathematically reconstruct victims' private keys remotely without ever touching the hardware wallets, making this one of the rare cases where a flaw in entropy generation led directly to large-scale theft.