Coldcard Bitcoin Wallet Bug Leads to $70M Theft

A flaw in Coldcard Bitcoin wallets let hackers guess private keys, draining over $70M. Users are urged to move funds now.

A serious security problem has been found in a popular device used to store Bitcoin, and hackers have already stolen more than $70 million worth of the cryptocurrency.

The device is called Coldcard, a type of hardware wallet (a small physical gadget, like a USB stick, that stores the secret codes needed to access your Bitcoin offline for extra safety). It is made by a company called Coinkite.

So what went wrong? When you set up a wallet, the device creates a seed phrase (a list of random words that acts like a master password to your funds). To be safe, this must be built from true randomness. But a software bug meant certain Coldcard devices didn't use real randomness — making the secret keys easy for hackers to guess and "crack."

Here are the key facts:

The bug appeared in Coldcard Mk3 devices starting in March 2021 (firmware version 4.0.1).
Seeds had only about 40 bits of randomness instead of the intended 128 bits — far too weak.
Hackers first drained 1,196 Bitcoin addresses.
So far around 1,082 Bitcoins — over $70 million — have been stolen.
Later devices (Mk4, Mk5, and Q) may also be at risk.

One user reported that Bitcoin sitting untouched since 2021 was suddenly "swiped" without warning. A Bitcoin security expert, Kevin Loaec, warned bluntly: "Everything is fucked," adding that every wallet code made with a Coldcard since 2021 could soon become public.

What should affected users do?

If you used a Coldcard, move your funds immediately to a safe new wallet.
Coinkite advises users who didn't use extra security (like 50 dice rolls to add randomness) to create a brand-new seed on an updated device.
Some experts suggest stopping use of Coldcard altogether to be safe.

The lesson for beginners: even trusted security devices can have hidden flaws. If you own crypto, always keep an eye on official updates from your wallet maker and act fast when warnings appear.

This is an AI-generated summary. Read the original article at: https://bitcoinmagazine.com/news/coldcard-wallet-exposed-after-bitcoin-hack