Coldcard firmware flaw leads to $130 million Bitcoin theft

A coordinated attack exploiting a years-old firmware flaw in Coldcard hardware wallets has led to the theft of at least 1,596 Bitcoin, worth over $100 million, from thousands of users, with losses continuing to mount. Blockchain analytics firm Galaxy Research confirmed on Tuesday, August 4, that three major waves of thefts have drained funds from approximately 7,300 wallet addresses, with a suspected fourth wave potentially pushing total losses to 2,055 Bitcoin, or roughly $130 million.

The vulnerability stems from a firmware bug introduced in March 2021 affecting Coldcard's Mk2, Mk3, and Mk4 models. The flaw caused the devices to use a flawed, deterministic pseudorandom number generator for seed phrase creation instead of a true hardware-based random generator. This significantly reduced the cryptographic entropy, making the private keys securing users' Bitcoin far easier for attackers to brute-force guess offline. Because the corresponding public keys are visible on the Bitcoin blockchain, attackers can scan for vulnerable wallets and systematically drain them.

The initial wave of thefts occurred on July 30, with 1,082.65 Bitcoin stolen from nearly 1,200 addresses in a...