Do Son 
The respected Bitcoin hardware wallet COLDCARD has disclosed a severe security failure. A build error dating back to March 2021 caused the wallet firmware to generate seed phrases using predictable device and clock values rather than proper randomness.
Under normal conditions, seed generation relies on pseudorandom numbers. A sufficiently long random input makes brute-force derivation exponentially harder. The flawed generator, however, collapsed the effective seed space from an astronomically large range down to a searchable one.
On the MK3 wallet, the designed seed space spans 128 bits. Because of the defect, the actual seed pool shrank to roughly 40 bits, a difference that turns an impossible search into a tractable one.
594 BTC Drained From 500 Wallets in 15 Minutes
On-chain data tells the rest of the story. An attacker exploited the flaw and swept 594.48 BTC, worth approximately $37.42 million, from 500 addresses in barely 15 minutes.
The entire operation required no user interaction at all. Many victims likely remain unaware that their wallets have been emptied. They will discover the loss only when they next open their wallet and find a zero balance.
How the Attack Worked
International Cyber Digest analysed the incident and laid out the method. The attacker rebuilt COLDCARD’s flawed seed generator on a local machine. For each seed, the attacker derived the corresponding Bitcoin addresses and then compared them against on-chain data.
Whenever a derived address held a balance, the attacker knew the wallet was active. Because the derivation process also produced the matching private key, the attacker could sign a transfer and move the funds out immediately.
Until affected users upgrade their firmware or migrate their balances, the attacker can theoretically keep deriving, scanning, matching, and draining wallets.
Firmware Update Required Immediately
COLDCARD’s security advisory confirms that multiple hardware wallet models are affected. The company has already released updated firmware to fix the flaw. Before upgrading, however, users should stop generating new seeds on the existing firmware, because any wallet created with the old code remains at risk.
So far, the company has not mentioned any potential compensation. Affected users may eventually pursue a class-action lawsuit. Otherwise, they face bearing the loss on their own.
COLDCARD says the investigation continues and promises a full technical report to maintain transparency.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
