Coldcard Wallets Hacked, $116 Million in BTC Stolen as Seed Phrase Flaw Exposed

A massive security breach has compromised thousands of Coldcard hardware wallets, resulting in the theft of approximately $116 million worth of Bitcoin. The attack, which began to gain attention last week, has affected over 4,500 users and is considered one of the most significant breaches of cold storage cryptocurrency wallets.

The vulnerability, discovered by Block's engineering team, stemmed from a flaw in how Coldcard devices generated seed phrases. These seed phrases are critical to wallet security, but the deterministic values used by Coinkite, the manufacturer of Coldcard devices, made them predictable to attackers.

Jonathan Goodman, one of the affected users, reported losing $1.6 million in Bitcoin that had been stored in cold storage on a Coldcard device in a safety deposit box. The realization for many victims came as a shock, with some initially believing their funds were secure due to being stored offline.