Hardware Wallet Flaw Exposes Users to $70 Million in BTC Losses

A critical firmware flaw in some Coldcard hardware wallets has allowed attackers to remotely drain funds from user accounts, resulting in losses exceeding $70 million in Bitcoin.

The issue stems from weak randomness in seed phrase generation on affected devices, which made it possible for hackers to reconstruct private keys without physical access.

The problem originated in firmware released in March 2021 and affects models shipped with that buggy firmware. Installing newer firmware resolves the underlying bug, but does not secure recovery seeds generated on affected devices.

Binance founder Changpeng Zhao weighed in on the incident, cautioning users to be aware of potential risks even with self-custody solutions like hardware wallets.