Coldcard Security Breach Sees $38M in BTC Stolen

A serious security flaw in Coldcard hardware wallets has resulted in the loss of approximately $38 million in Bitcoin. Attackers managed to drain nearly 600 BTC from around 500 dormant wallets in just 25 minutes. Most of the stolen funds remain in a single address held by the attackers.

Coinkite, the maker of the wallet, confirmed that seed generation in the Mk3 model may have lacked sufficient randomness. While the company initially stated that newer models like the Mk4 and Q were safe, independent researchers from Block discovered similar flaws across multiple versions. It appears a miswritten code check caused the devices to use a weak pseudo random number generator instead of the intended hardware security.

Experts suspect that artificial intelligence played a role in identifying the vulnerability. Developers found that by feeding the open source firmware into AI models, it was possible to pinpoint the exact location of the code error. One developer confirmed that using AI agents allowed them to reproduce the exploit in short order.

Security researchers are now advising users to be extremely cautious. Because the flaw relates to how private keys were originally generated, moving funds to a new wallet with a fresh seed phrase is the only way to ensure security. Bitcoin holders should monitor official updates from the company closely as the investigation continues.