Coldcard exploit drains $114 million, users told to migrate

The developers of the Coldcard hardware wallet are urging users to urgently move their bitcoin holdings as an active exploit continues to drain funds from vulnerable devices, with cumulative losses now estimated as high as $114 million. The vulnerability, which remained undetected for five years, stems from a flaw in the seed generation process introduced in a March 2021 firmware update.

Manufacturer Coinkite disclosed that the flaw inadvertently routed the wallet creation process to a weaker, pre-existing pseudorandom number generator in the device's codebase instead of the intended true random number generator (TRNG). This weakness allows attackers to guess or predict the seed phrases-the master keys controlling the wallets-and drain funds without needing physical access to the device. The ongoing attack has impacted thousands of addresses, with one wave on August 3 reportedly sweeping approximately 449 bitcoin from over 700 addresses.

The vulnerability is confined to specific device models and firmware versions. Owners of Coldcard's Mk3 model are at risk if the wallet was set up on firmware version 4.0.1 or later. Users of Mk4, Mk5, and Q models are vulnerable if running...