Coldcard Wallets Face Growing Security Breach

A critical firmware bug in Coldcard hardware wallets has turned into an ongoing security crisis. Recent reports indicate that at least 15 independent attackers are actively scanning the blockchain to drain Bitcoin from wallets generated with flawed software. Losses have already climbed past $130 million across more than 7,000 affected addresses.

The vulnerability stems from a faulty random number generator used during seed creation. Instead of high entropy, the affected devices generated seed phrases that are significantly easier for hackers to guess through brute force. Because these public keys are permanently recorded on the blockchain, they remain exposed to anyone with the right computational power.

Coinkite, the maker of the devices, has issued firmware updates to address the issue. However, the company warns that updating the software does not fix a seed phrase that was already generated incorrectly. Users are strongly advised to move their funds to a completely new, secure wallet immediately.

While law enforcement is currently investigating, most of the stolen Bitcoin remains stationary in the attackers' addresses. Owners of Coldcard devices should check the status of their wallets and consider reporting any suspicious activity to the proper authorities.