Coldcard Wallets Hit by $70M Bitcoin Heist via Firmware Flaw

A significant security flaw in Coldcard Wallets has resulted in one of the largest Bitcoin hardware wallet thefts in recent months. The vulnerability, which remained unnoticed for years, allowed an attacker to recreate wallet private keys offline by exploiting a weakness in how some Coldcard wallets generated recovery seed phrases.

The attack targeted over 1,100 wallets created on Coldcard Mk3 devices running firmware versions 4.0.1 through 5.0.3, originally released in March 2021. The attacker drained more than 1,082 BTC, worth around $70 million, within just 41 minutes on July 30.

Researchers believe the attacker generated millions of possible wallet keys in advance and simply waited for matching wallets to appear on the Bitcoin network. Coinkite has urged anyone who generated a recovery phrase on affected firmware to immediately move funds to a newly created wallet using the latest firmware.