Coldcard Bitcoin Wallet Flaw Leads to Fourth Attack Wave

TLDR

• A fourth attack wave moved 448.7 Bitcoin from 709 suspected victim addresses, according to Galaxy Research.
• Combined losses across all four waves are estimated near 1,815 Bitcoin from 5,294 addresses.
• Coinkite traced the flaw to a 2021 firmware update that swapped its true random number generator for a weaker one.
• Kraken security chief Nick Percoco says the case shows hardware wallets lack independent testing standards other devices already use.
• Coldcard has halted shipments, destroyed affected stock, and released fixed firmware, but users still must move funds to new seeds.

Coldcard, a maker of Bitcoin hardware wallets, is facing a wave of thefts tied to a firmware flaw that went unnoticed for five years. Blockchain research firm Galaxy Research says a fourth attack wave hit over the weekend.

That wave moved 448.7 Bitcoin from 709 suspected victim addresses. Galaxy’s head of research, Alex Thorn, called the addresses “likely Coldcard victims” based on transaction patterns, not confirmed device records.

Across all four waves, Galaxy estimates roughly 1,815 Bitcoin has been taken from 5,294 addresses. That number is not confirmed by Coinkite, police, or every wallet owner involved, and it assumes the victim groups don’t overlap.

How the Flaw Happened

Coinkite, the company behind Coldcard, says the problem began in March 2021 during a change to its cryptographic library. The update accidentally routed seed creation to a weaker software-based random number generator instead of the device’s intended hardware generator.

Coinkite said in its report that the weaker generator existed in the source code without the team knowing it was being called. Affected models include the Mk2, Mk3, Mk4, Mk5, and Q, each losing a different amount of randomness as a result.

Block’s engineering team reviewed the issue on its own and confirmed the firmware was calling the weaker fallback generator instead of the true hardware source. Block said it had not run full tests to confirm the flaw could be exploited, but agreed early disclosure was needed given the theft reports.

What Users Need to Do

Coinkite has released fixed firmware for every affected model. Installing it does not repair wallets that already created a weak seed.

Anyone with an older seed needs to generate a new one on the updated firmware, test it with a small transfer, then move the rest of their funds. Seeds made with at least 50 dice rolls, or protected by a strong passphrase, are not considered exposed by this specific issue.

Galaxy Research says some flagged transactions are still sitting unconfirmed in Bitcoin’s network. That gives affected owners a narrow chance to move funds first by sending a new transaction with a higher fee.

This only works before the original transaction is confirmed in a block, and there is no guarantee the replacement will succeed.

Kraken’s chief security officer, Nick Percoco, said the case points to a gap in how hardware wallets get tested. He compared it to standards already used for other cryptographic devices, saying wallet makers have no equal system to confirm which random number generator is actually running in production.

Coinkite halted all device shipments after confirming the bug and destroyed unsold units carrying the flawed firmware. The company has asked users not to throw away old devices, saying they may help identify stolen funds later.

Coinkite says its legal team plans to work with law enforcement in multiple countries as the investigation into the thefts continues.

The post Coldcard Bitcoin Wallet Flaw Leads to Fourth Attack Wave appeared first on Blockonomi.