Hardware Wallets Expose Bitcoin Holders to Massive Losses After Firmware Flaw Enables Remote Drains

Hardware wallet users face sudden losses exceeding $70 million in Bitcoin (BTC) after a critical firmware flaw allows remote draining of funds.

Attackers exploited weak randomness in seed phrase generation on affected Coldcard devices to reconstruct private keys without any physical access.

According to CoinKite, the error caused some devices to generate recovery seeds using a software-based source of randomness instead of the built-in hardware random-number generator, making the resulting private keys significantly easier to predict.

The issue originated in firmware released in March 2021. While installing newer firmware resolves the underlying bug, it does not secure recovery seeds that were generated on affected devices.

Galaxy Research tracked the sweep across 1,196 addresses totaling 1,082.65 BTC in roughly 41 minutes, nearly doubling earlier loss estimates of around $38 million.

Many compromised wallets had stayed inactive for years, making them particularly vulnerable to the predictable seed flaw in models shipped with the buggy firmware.

… Continue reading the full article at the original source below.