Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes
Read original article ↗AI Summary
A critical firmware flaw in Coldcard hardware wallets, stemming from a 2021 integration error, led to the theft of approximately $70.2 million in Bitcoin (1,082.65 BTC) from 1,196 addresses within 41 minutes on July 30, 2026. The vulnerability arose because seed generation used a deterministic software pseudorandom number generator (PRNG) instead of the intended hardware RNG, reducing effective entropy to as low as 40 bits. Coinkite released emergency firmware updates, but existing compromised seeds remain vulnerable unless regenerated on patched firmware. The attack exploited predictable BIP-39 seed generation, allowing offline reconstruction of candidate seeds by correlating device UID, timer state, and RNG call history with public blockchain data.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.