15 attackers exploit Coldcard flaw, stealing ~1,600 Bitcoin

A major vulnerability in Coldcard hardware wallets has been exploited by at least 15 distinct attackers, leading to confirmed thefts of approximately 1,596 Bitcoin, valued at roughly $100 million, according to new research from Galaxy Digital. The firm's investigation, which incorporates fresh victim reports, has identified three confirmed waves of attacks and a suspected fourth wave that could push total losses to about 2,055 Bitcoin, or nearly $130 million.

The attacks target a firmware flaw affecting Coldcard Mk3, Mk4, Mk5, and Coldcard Q devices. The vulnerability originated in a March 2021 firmware change, disclosed last week by manufacturer Coinkite. Instead of using the device's intended hardware-based random number generator for seed creation, affected firmware mistakenly relied on a deterministic pseudorandom generator. This error drastically reduced the effective entropy, or randomness, used to generate private keys. Coinkite estimates that vulnerable Mk2 and Mk3 devices may have provided only about 40 bits of entropy, while affected Mk4, Mk5, and Q models generated about 72 bits, far below the intended 128-bit security standard. This smaller search space made the...