Home›Crypto›Market Structure›Coldcard flaw exploited to drain about $38 million in…

Coldcard flaw exploited to drain about $38 million in bitcoin

The theft moved roughly 594 BTC across about 500 single-signature wallets in under 30 minutes, then consolidated most of the funds into a single address that has not moved.

Reported · Written up by our desk · Market Structure

CoinDesk reports that an attacker exploited a key generation randomness bug in some Coldcard hardware wallets to steal roughly 594 bitcoin, valued at about $38 million, from around 500 single-signature wallets in under 30 minutes.

The issue was introduced in Coldcard firmware 4.0.0 in March 2021. According to CoinDesk, affected devices skipped their hardware randomness generator and instead used a predictable software-based key generation method seeded by nonsecret chip data, so the wallets could be drained despite seeds being intended to be drawn from an effectively unguessable random pool.

CoinDesk said the sweep occurred between 01:31 and 01:56 UTC on Friday, moving 1,324 bitcoin chunks across 500 transactions within a three-block window. It also noted that 562 BTC was then consolidated into a single address that has not moved, and that drained wallets were dormant for years, spanning holdings from 2021 to 2026.

CoinDesk added that Coinkite warned users who created seeds on Mk3 devices running firmware 4.0.1 or later, while saying Mk4, Q, and Mk5 appear unaffected so far. The outlet also reported that the theft has had little visible impact on bitcoin’s market price.

Latest closeBitcoin $62,929.67 ▼2.8%

More like this

Sources