🚨 594 BTC ($38M) STOLEN IN JUST 25 MINUTES
A firmware flaw in Coldcard hardware wallets let an attacker drain around 500 single-sig wallets overnight — some dormant for years.
The bug traces back to a weak random number generator that made seed phrases guessable instead of truly random, affecting Mk3 devices (and possibly later models) going back to 2021.
Key lesson here:
Even the most "secure" hardware wallet is only as safe as its code. Single-signature setups took the full hit — multisig wallets across different manufacturers remained untouched.
$BTC barely reacted price-wise, still holding near $63K-$64K, but this is a wake-up call for anyone doing long-term cold storage.
If you're using Coldcard (or any single device for large holdings), consider moving to a multisig setup across different brands.
Your keys, your coins — but only if they're actually random.
NFA - Not Financial Advice, DYOR
A firmware flaw in Coldcard hardware wallets let an attacker drain around 500 single-sig wallets overnight — some dormant for years.
The bug traces back to a weak random number generator that made seed phrases guessable instead of truly random, affecting Mk3 devices (and possibly later models) going back to 2021.
Key lesson here:
Even the most "secure" hardware wallet is only as safe as its code. Single-signature setups took the full hit — multisig wallets across different manufacturers remained untouched.
$BTC barely reacted price-wise, still holding near $63K-$64K, but this is a wake-up call for anyone doing long-term cold storage.
If you're using Coldcard (or any single device for large holdings), consider moving to a multisig setup across different brands.
Your keys, your coins — but only if they're actually random.
NFA - Not Financial Advice, DYOR