Coldcard warns exploit drained $114 million from self-custodial Bitcoin wallets
Coldcard just put out a serious heads-up: an active exploit has been draining funds from self-custodial bitcoin wallets, with losses hitting around $114 million.
The bug hits certain Mk3 devices set up on firmware 4.0.1 or newer, plus Mk4, Mk5, and Q models on older software, but if you set up your wallet using their dice-roll feature, you are in the clear.
Attackers can guess wallet seed keys
This vulnerability lets attackers guess weak seed keys and grab people's bitcoin, especially affecting people who haven't kept their devices updated.
Coldcard is urging owners of affected Mk3 devices set up on firmware 4.0.1 or later, and Mk4, Mk5, and Q devices on older firmware below 5.6.0 or 1.5.0Q, to update their firmware as soon as possible, make new seed keys, and move funds to a wallet.
If you know someone who might not be following updates closely, now is a good time to check in and help them out.
Despite the hack, bitcoin's price is holding steady at about $63,800.