Home›Crypto›Market Structure›Coldcard hardware wallet flaw linked to $70M Bitcoin t…

Coldcard hardware wallet flaw linked to $70M Bitcoin theft

Coinkite said the issue affected Coldcard Mk3 and later models, and Galaxy Research data tied the drain to 1,082.7 BTC missing from affected wallets.

Reported · Written up by our desk · Market Structure

Coldcard maker Coinkite disclosed that its Coldcard hardware wallet line was exposed after a reported hack tied to roughly $70 million in Bitcoin. The company first warned Thursday that the Coldcard Mk3 model was affected, advising users to move funds, and then expanded the caution Friday to users of the later Mk4, Mk5 and Q devices.

According to Bitcoin Magazine, hackers drained funds from 1,196 Bitcoin addresses after private keys were generated with insufficient randomness. The report cites data from Galaxy Research and engineers at payments company Block showing that, in total, 1,082.65 BTC had disappeared from wallets linked to the affected setup.

Coinkite and engineers said a wallet seed generation bug meant the hardware true random number generator was not used on certain firmware versions. Instead, seed generation reportedly fell back to a weaker software PRNG, with seeds containing about 40 bits of entropy rather than the intended 128 bits, making private keys for certain single-signature wallets predictable enough for attackers to brute-force.

The article says 594.5 BTC worth over $35.7 million were moved to a new address from single-signature addresses on Thursday, and that drains were reportedly still ongoing as investigations continued. Coinkite urged users to review the company’s official security guidance as soon as possible.

Latest closeBitcoin $62,929.67 ▼2.8%

More like this

Sources