Hardware wallet users face sudden losses exceeding $70 million in Bitcoin (BTC) after a critical firmware flaw allows remote draining of funds.
Attackers exploited weak randomness in seed phrase generation on affected Coldcard devices to reconstruct private keys without any physical access.
According to CoinKite, the error caused some devices to generate recovery seeds using a software-based source of randomness instead of the built-in hardware random-number generator, making the resulting private keys significantly easier to predict.
The issue originated in firmware released in March 2021. While installing newer firmware resolves the underlying bug, it does not secure recovery seeds that were generated on affected devices.
Galaxy Research tracked the sweep across 1,196 addresses totaling 1,082.65 BTC in roughly 41 minutes, nearly doubling earlier loss estimates of around $38 million.
Many compromised wallets had stayed inactive for years, making them particularly vulnerable to the predictable seed flaw in models shipped with the buggy firmware.
Coinkite, the maker of Coldcard, acknowledged the issue and released emergency firmware patches to address the randomness problem across multiple device versions.
Binance founder Changpeng Zhao (CZ) chimes in and says,
“Even hardware wallets can have bugs, even old wallets with a long history can have bugs. How to mitigate? Split your funds in a few wallets maybe? This has a different set of risks. Nothing is 100%. Stay informed. Stay SAFU.”
The incident underscores ongoing risks in self-custody solutions despite their offline design and prompts broader discussions on wallet diversification strategies
Follow us on X, Facebook and Telegram
Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox
 
Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any assets including cryptocurrencies, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.
Generated Image: Midjourney