🛡 Disclosure of 5-Year-Old Bug in Coldcard Hardware Wallets and Massive Bitcoin Theft
🛡 Disclosure of 5-Year-Old Bug in Coldcard Hardware Wallets and Massive Bitcoin Theft
Background
🔹 Hackers exploiting an old software bug (dating back to March 2021) in Coldcard hardware wallets manufactured by the Canadian company Coinkite
🔹 The start of a wave of remote thefts on July 30, 2026, draining billions of tomans worth of Bitcoin from thousands of Cold Storage addresses
Focus
📌 Cause of vulnerability: An error in the seed phrase generation process; instead of using a hardware random number generator chip, the system resorted to a weak software algorithm.
📌 Severe entropy drop (key security): The cryptographic strength of generated private keys dropped from 128 bits to about 40 bits; making guessing and brute-force attacks possible without physical access to the device.
📌 Extent of damage: Over 1,800 Bitcoin stolen (equivalent to $116 to over $140 million) from more than 5,200 addresses so far.
📌 Update limitation: Firmware updates are only effective for creating new wallets, and accounts whose seed phrases were previously generated with the vulnerable version remain at risk.
Consequences
⚡️ Shattering the invulnerability myth of cold storage: Creating a wave of concern among long-term Bitcoin holders and the transfer of over $15 billion in Bitcoin to safer addresses or Multi-sig structures.
⚡️ Urgent need for user action: All users who generated their seed phrases between March 2021 and the release of the security patch on Coldcard devices must immediately transfer their assets to a new and secure seed phrase.
Conclusion
🎯 The Coldcard vulnerability is a reminder that no device is 100% immune to software bugs. For maximum security of large assets, using Multi-sig solutions with disparate hardware devices is the best alternative to single-device reliance.
#Coldcard #Coldcard #Hardware_Wallet #Crypto_Security #Bitcoin #Hack
Background
🔹 Hackers exploiting an old software bug (dating back to March 2021) in Coldcard hardware wallets manufactured by the Canadian company Coinkite
🔹 The start of a wave of remote thefts on July 30, 2026, draining billions of tomans worth of Bitcoin from thousands of Cold Storage addresses
Focus
📌 Cause of vulnerability: An error in the seed phrase generation process; instead of using a hardware random number generator chip, the system resorted to a weak software algorithm.
📌 Severe entropy drop (key security): The cryptographic strength of generated private keys dropped from 128 bits to about 40 bits; making guessing and brute-force attacks possible without physical access to the device.
📌 Extent of damage: Over 1,800 Bitcoin stolen (equivalent to $116 to over $140 million) from more than 5,200 addresses so far.
📌 Update limitation: Firmware updates are only effective for creating new wallets, and accounts whose seed phrases were previously generated with the vulnerable version remain at risk.
Consequences
⚡️ Shattering the invulnerability myth of cold storage: Creating a wave of concern among long-term Bitcoin holders and the transfer of over $15 billion in Bitcoin to safer addresses or Multi-sig structures.
⚡️ Urgent need for user action: All users who generated their seed phrases between March 2021 and the release of the security patch on Coldcard devices must immediately transfer their assets to a new and secure seed phrase.
Conclusion
🎯 The Coldcard vulnerability is a reminder that no device is 100% immune to software bugs. For maximum security of large assets, using Multi-sig solutions with disparate hardware devices is the best alternative to single-device reliance.
#Coldcard #Coldcard #Hardware_Wallet #Crypto_Security #Bitcoin #Hack
Persian original · View this post on Telegram ↗ · Open in the archive · 💬 Discuss in the Coin_Kurd Telegram group · Educational, not financial advice.