594 BTC drained in 25 minutes as Coldcard flaw sparks alarm

Coinkite has warned owners of its Coldcard Mk3 hardware wallet that any Bitcoin seed generated since March 2021 may be vulnerable after discovering a flaw that could make those seeds predictable. The warning came the same day about 594 BTC—worth roughly $38 million—was drained from around 500 wallets.

Users who purchased Coldcard primarily for its security features will right away want to know which models still maintain safety. At first, Coinkite only stated that the Mk3 was affected while new models like Mk4, Q, and Mk5 were dubbed “not affected based on our early analysis,” as stated by The Block. However, in its later notice, the company mentioned that those newer models also create seeds with only 72 bits of entropy instead of 128 bits as was originally intended, albeit in a different way because of a different design.

Which Coldcards are safe, and which are not

The problem is associated with the firmware, not with the hardware.

As reported by Block’s Bitcoin engineering and security team, Mk1 had never run buggy code. Also, Mk2 and Mk3 devices with firmware upgraded to 3.2.2 or later were generating their seed properly using a hardware random number generator.

… Continue reading the full article at the original source below.