Coldcard Hardware Wallet Bug Leads to 1,300+ Bitcoin Theft

Coldcard, a popular Bitcoin hardware wallet manufactured by Coinkite, experienced a security vulnerability last week that exposed a firmware bug in its entropy generation system. The flaw, which went undiscovered for years, resulted in Bitcoin private keys that were mathematically easier to guess than intended, leading to the theft of over 1,300 bitcoins with some estimates as high as 2,000 coins. The vulnerability prompted over 11,000 bitcoins to be moved to custodial exchanges as users sought alternatives. The bug stemmed from the device's failure to use high-quality sources of randomness when generating private keys, despite Coldcard's design emphasis on airgapped security, LED screens, and protocols like BBQR and NFC integration. Users can still take action to protect themselves from the ongoing threat.

Coldcard Vulnerability Exposed Entropy Generation Flaw

The security breach exploited a fundamental weakness in how Coldcard devices generated private keys. While the hardware wallets were designed to use high-quality sources of entropy—randomness that makes secrets mathematically hard to guess—a firmware bug prevented this from functioning properly. The devices featured airgapped design to prevent malware from exfiltrating data through USB cables, low-resolution LED screens to avoid touchscreen complexity, and protocols like BBQR with NFC integration for secure data transfer. However, these security features could not compensate for the entropy generation failure. The bug remained undetected for years as the product grew in popularity.

Users Moved 11,000 Bitcoins to Custodial Exchanges

Following the discovery of the vulnerability, over 11,000 bitcoins were transferred to custodial exchanges last week as users abandoned the affected hardware wallet. The theft is ongoing, with more than 1,300 bitcoins confirmed stolen and estimates reaching as high as 2,000 coins. Coinkite and its founder NVK had previously advocated for specific approaches to securing Bitcoin private keys from hackers, making the breach particularly significant for users who had relied on the company's security philosophy.

Ongoing Threat Requires User Action

Users of affected Coldcard devices can still take steps to protect their holdings from the continuing threat. The vulnerability remains active, and protective measures are available for those who have not yet been compromised.

FAQ

What caused the Coldcard security vulnerability? A firmware bug prevented Coldcard devices from using high-quality sources of entropy when generating Bitcoin private keys, making the keys mathematically easier to guess than intended. The flaw went undiscovered for years despite the device's other security features.

How many bitcoins were affected by the Coldcard hack? Over 1,300 bitcoins were confirmed stolen, with some estimates as high as 2,000 coins. Additionally, over 11,000 bitcoins were moved to custodial exchanges last week as users sought alternatives to the compromised hardware wallet.