Coldcard Bitcoin Theft Ongoing: Is Your Wallet Affected?

A firmware error has disabled secure random number generation across multiple Coldcard hardware wallet generations, fueling an ongoing theft that has already drained 594.48 Bitcoin (BTC), worth about $38.3 million.

Coldcard maker Coinkite and Block's Bitcoin engineering team traced the bug to a broken random number generator (RNG) check. As a result, attackers can rebuild a wallet's private keys using predictable device details instead of true randomness.

Coldcard Bitcoin Theft: How It Happened

Coldcard's firmware turns off the chip's built-in randomness generator. Instead, a backup system builds wallet keys from the device's serial number and its internal clock. Both follow patterns an attacker can guess, turning a supposedly random seed into a solvable puzzle.

Devices running certain firmware released since 2021 get almost no real randomness at all. Newer models add a partial fix. It still narrows the possible outcomes to roughly four billion combinations, a number modern computers can work through. Historically, Block traced the flaw to that 2021 update, and a follow-up fix a year later still fell short.

… Continue reading the full article at the original source below.