Coldcard Security Flaw Puts $130 Million in BTC at Risk

A serious firmware bug in Coinkite Coldcard wallets has compromised the security of approximately $130 million in Bitcoin. Developers discovered that several models failed to generate truly random keys. Instead of using secure hardware, the devices fell back to a predictable method that made seed phrases significantly easier for attackers to guess or reconstruct.

The issue primarily affects Mk2 and Mk3 models running firmware versions 4.0.1 through 4.1.9. While newer models like the Mk4, Q, and Mk5 were also impacted, they produced seeds with slightly more, though still insufficient, entropy. Because the flaw occurs at the exact moment the seed is created, a firmware update cannot fix keys that have already been generated. Users with affected devices must create a new wallet and transfer their funds to a fresh address.

This incident highlights a major vulnerability in relying on a single device for security. Even if a user kept their device offline and protected their seed phrase, the initial weakness in how the key was created rendered those efforts ineffective. Simply moving a compromised seed phrase to a different brand of wallet will not resolve the issue, as the weakness is tied to the seed itself.

There is a silver lining for some users. Those who added their own entropy through independent dice rolls or used a strong, unique BIP 39 passphrase were largely protected, as these steps provided security outside of the device's flawed random number generator. Industry experts suggest this is a wake up call for Bitcoin holders to avoid over reliance on a single point of failure when managing their private keys.