Coldcard Hardware Wallet Flaw Exposes Bitcoin Seeds After $70M Hack

Users of Coldcard hardware wallets are rushing to move their funds after a major security flaw led to the theft of more than $70 million in Bitcoin. Investigators found that a firmware bug in the Mk3 model, dating back to March 2021, caused the device to use weak randomness instead of its true random number generator when creating wallet seeds. This made the private keys predictable and easy for attackers to crack.

Following the initial attacks on Thursday, blockchain data revealed that over 1,000 Bitcoins had disappeared from user addresses. Coinkite, the company behind Coldcard, initially advised Mk3 users to move their funds before expanding precautions to later models including the Mk4, Mk5, and Q devices. Security experts are warning that older wallets created without extra steps like manual dice rolls could be completely compromised.

Bitcoin developers and security specialists are urging anyone who set up a Coldcard wallet in recent years to transfer their coins to a secure, newly generated seed on a different device. Coinkite has published official guidance for affected users as investigations continue into the ongoing wallet drains across the network.