$75M Stolen from Coldcard Hardware Wallets Due to Firmware Flaw
A critical vulnerability in the firmware of Coldcard hardware wallets has led to a theft of approximately $75.1 million worth of Bitcoin (BTC). The flaw, introduced on March 1, 2021, caused devices to use an insecure software-based random number generator instead of a secure hardware one during seed generation. This reduced entropy from 128 bits to as low as 40 bits, making it possible for attackers to brute-force private keys and steal funds without physically accessing the wallets. The theft occurred in two waves between July 30 and August 1, with victims losing over $30 million within ten minutes. Despite the massive scale of the breach, none of the stolen Bitcoin has been moved yet—raising questions about whether it will be laundered or if the attacker is waiting for attention to fade. Interestingly, the market reaction was muted; Bitcoin's price remained relatively stable around $62,900 as of August 1. However, experts warn that while this specific theft did not exploit newer firmware versions (Mk4 and above), they still have reduced entropy levels compared to industry standards.
Topics: Bitcoin Coldcard hacks hardware wallets theft