#crypto
A critical firmware flaw in Coldcard hardware wallets allowed attackers to steal approximately $70 million in $BTC from over 1,000 wallets. The vulnerability bypassed the hardware True Random Number Generator (TRNG) when generating seed phrases, resulting in predictable software keys being generated instead of truly random keys, which could be brute-forced.
What Caused the Vulnerability
The flaw was introduced into the firmware in March 2021 and affected versions v4.0.0–v5.0.3. Initially, the issue affected the Mk2 and Mk3 models, and later spread to several other device versions.
Instead of using a hardware source of true randomness, the device would, in certain cases, switch to a weak pseudo-random number generator (PRNG). This made the generated seed phrases and corresponding private keys potentially predictable.
The most dangerous aspect of the vulnerability was that the attackers didn't need physical access to the wallet. All they needed was to know or determine the victim's public address, after which they could calculate the corresponding private key for vulnerable devices and transfer all the bitcoins stored on them to their own addresses.
It was this flaw, according to reports, that led to the theft of approximately $70 million in $BTC from over 1,000 Coldcard hardware wallets.
A critical firmware flaw in Coldcard hardware wallets allowed attackers to steal approximately $70 million in $BTC from over 1,000 wallets. The vulnerability bypassed the hardware True Random Number Generator (TRNG) when generating seed phrases, resulting in predictable software keys being generated instead of truly random keys, which could be brute-forced.
What Caused the Vulnerability
The flaw was introduced into the firmware in March 2021 and affected versions v4.0.0–v5.0.3. Initially, the issue affected the Mk2 and Mk3 models, and later spread to several other device versions.
Instead of using a hardware source of true randomness, the device would, in certain cases, switch to a weak pseudo-random number generator (PRNG). This made the generated seed phrases and corresponding private keys potentially predictable.
The most dangerous aspect of the vulnerability was that the attackers didn't need physical access to the wallet. All they needed was to know or determine the victim's public address, after which they could calculate the corresponding private key for vulnerable devices and transfer all the bitcoins stored on them to their own addresses.
It was this flaw, according to reports, that led to the theft of approximately $70 million in $BTC from over 1,000 Coldcard hardware wallets.