Coldcard firmware flaw enables theft of 1,000 BTC (~$70M)

A coordinated attack exploiting a firmware vulnerability in Coldcard hardware wallets drained more than 1,000 bitcoin, worth approximately $70 million, from nearly 1,200 addresses in a 41-minute window on July 30, according to research from Galaxy Research. The theft, which nearly doubled initial loss estimates, represents one of the most significant hardware wallet compromises to date because attackers never needed physical access to the devices or users' recovery phrases.

The funds, totaling 1,082.65 BTC, were swept from the wallets between 01:10 and 01:51 UTC across six Bitcoin blocks. Researchers noted the transactions were broadcast in batches, with three intervening empty blocks. The stolen proceeds currently reside in four addresses and have not moved.

The core vulnerability was a firmware bug introduced in March 2021 that affected the wallet creation process on certain devices. Instead of using a secure, dedicated hardware random number generator to create a cryptographically unpredictable seed phrase, an internal build setting mistakenly instructed the firmware to bypass this hardware. A flawed software validation check failed to detect the problem, causing the system...