Coldcard Security Breach Sees $70 Million Stolen

A serious security vulnerability in Coldcard hardware wallets has resulted in the loss of $70 million worth of Bitcoin. Researchers at Galaxy and Block discovered that a coding mistake introduced in 2021 made wallet seed phrases predictable by relying on weak data sources like serial numbers. Attackers were able to generate these seeds, scan the blockchain for funds, and drain 1,196 wallets in under an hour on July 30.

Changpeng Zhao, the founder of Binance, commented on the incident to highlight that no storage method is entirely foolproof. He suggested that users consider splitting funds across multiple wallets to mitigate total loss, although he noted that this strategy introduces its own complexities. The incident serves as a stark reminder that even long standing, trusted hardware brands are subject to technical errors.

Users who own Coldcard devices should update their firmware immediately. However, an update cannot fix a seed that is already compromised. If a wallet was set up while the vulnerable firmware was active, the owner must generate a fresh seed and transfer funds to a new address. Experts recommend using manual dice rolls during setup and adding a strong passphrase to bolster security, as there is currently no simple tool for users to test if their specific seed is at risk.