Coldcard hardware wallets hacked: 584 bitcoin stolen from 500 devices
In just 25 minutes, hackers managed to steal 584 bitcoin (about $38 million) from 500 Coldcard hardware wallets.
The attack was super targeted: all the affected wallets were single-signature and had more than 0.15 BTC each.
A portion of the stolen coins (562 BTC) was pooled into a single address, making it a huge hit in a short time.
Coinkite confirms Mk3 4.0.1 wallets affected
Turns out, the hack happened because of a flaw in how Coldcard generated wallet keys. Instead of using its hardware random number generator, it relied on weaker software tied to the chip's serial number and time counter.
Coinkite (the company behind Coldcard) confirmed this only impacted Mk3 wallets running firmware 4.0.1 or newer. Mk4, Q, and Mk5 models are safe.
This bug also affected things like paper wallet keys and seed-splitting masks, adding to $1 billion lost in crypto hacks during the first half of the year (according to Blockaid).