A critical firmware vulnerability in Coldcard hardware wallets has resulted in the theft of approximately 1,600 to 2,000 Bitcoin, representing over $100 million in losses. The exploit originated from a miswired random number generator in a 2021 firmware update, which caused the device to generate weak, predictable private keys. Unlike typical phishing or bridge hacks, this breach targeted security-conscious, long-term holders who followed established self-custody protocols. Forensic analysis reveals the attack unfolded in multiple waves, with attackers leveraging high-compute power to derive keys across the derivation space. This incident underscores the dangers of insufficient code audits and non-transparent development practices. Beyond the immediate financial impact, the breach serves as a stark warning for the broader financial industry regarding the vulnerability of cryptographic systems to high-compute threats and the looming risks posed by future quantum computing capabilities.
Sign in to continue reading, translating and more.
Open full episode in Podwise