Coldcard Wallets Drain Nearly $38M Amid Key-Generation Weakness

A major Bitcoin wallet flaw has drained nearly $38 million from about 500 older single-signature wallets linked to Coldcard key-generation weakness.

The attack unfolded between 01:31 and 01:56 UTC on Friday, during which an attacker moved 1,324 chunks of Bitcoin across approximately 500 transactions.

Block's Bitcoin engineering and security teams traced the issue to weak randomness tied to serial numbers and clock registers in affected Coldcard firmware versions 4.0.1 to 5.0.3.