Coldcard Wallets Exposed: $130M Worth of Bitcoin Stolen Through Firmware Flaw

A major security flaw in Coldcard hardware wallets has led to the theft of nearly $130 million worth of Bitcoin, with around 2,000 addresses affected. The vulnerability dates back to a firmware update in March 2021 and allows attackers to reconstruct wallet seeds without physical access to the device.

The issue arises from a predictable software pseudo-random number generator being used instead of the hardware true random number generator during seed creation. This has resulted in wallet seeds containing as few as 40 bits of effective entropy, making them vulnerable to reconstruction attacks.

At least 15 distinct attackers have exploited this flaw without physical device access, with around 90% of stolen funds remaining unmoved. The incident has triggered calls for mandatory independent entropy testing across all hardware wallet manufacturers and a wave of AI-assisted security analysis of Bitcoin wallet codebases.