594
$BTC gone in 25 minutes. About $38 million. From wallets everyone assumed were the safe kind The setup:
→ Roughly 500 Coldcard hardware wallets drained in a single sweep
→ Every address hit was single-sig and dormant
→ Each held at least 0.15 BTC
→ 562 BTC now sit in one address, untouched since
The actual bug:
→ Traces back to March 2021
→ Devices silently skipped their hardware randomness chip
→ Seed entropy dropped from 128 bits down to roughly 40
→ That's not a small gap, that's the difference between unbreakable and guessable
The part that should worry the whole industry:
→ Coinkite's