A security flaw in Coldcard wallets has led to the theft of 594 BTC, valued at $38 million, affecting nearly 500 wallets.
Security flaw in Coldcard wallets allows for loss exceeding $38 million.
A significant security vulnerability in Coldcard hardware wallets has led to the theft of 594 bitcoin, valued at approximately $38 million, from nearly 500 single-signature wallets. The theft occurred in a remarkably swift manner, taking place between 01:31 and 01:56 UTC on Friday.
This issue arose due to a flaw introduced in the firmware version 4.0.0 released in March 2021, which caused the devices to bypass their hardware randomness generator. Instead, they resorted to a predictable software-based method for key generation, using non-secret chip data.
The attack involved 1,324 transactions executed within a three-block window, with a total of 562 BTC later consolidated into a single inactive address. Most of the compromised wallets had been inactive for years, with their creation dates coinciding with the time the vulnerability was identified.
Coinkite, the Canadian manufacturer of Coldcard wallets, has alerted users who generated wallet seeds on Mk3 devices running firmware version 4.0.1 or newer. They have indicated that the Mk4, Q, and Mk5 models currently appear to be unaffected by this flaw.
The vulnerability highlights a critical issue with the firmware's implementation of random seed generation. According to findings from Block's Bitcoin engineering and security teams, a build setting inadvertently directed the device to bypass its hardware randomness generator, leading to the generation of keys based on easily accessible chip data.
Coinkite has acknowledged the problem following Block's disclosure of its findings, but both companies are treating their evaluations as preliminary. Furthermore, the flawed generator also affects the production of private keys for Coldcard's paper wallets and other security features.
Despite the magnitude of the theft, bitcoin's market price, which was above $64,000 at the time, showed minimal impact from the incident.
