Coldcard code flaw left undetected for years, leading to $100M BTC theft

A code flaw in the seed phrase generation process of hardware wallet maker Coldcard went undetected for years and led to the theft of about $100 million worth of BTC, CoinDesk reported. Galaxy Research estimated that 1,596 BTC was stolen from about 7,300 addresses. The vulnerability emerged during a firmware overhaul in 2021. Although Coldcard was designed to generate seeds using sufficient randomness from dedicated hardware, a configuration error caused it to use a more predictable software-based method instead, sharply reducing the entropy needed for seed generation. Analysts concluded this allowed attackers to estimate possible seed combinations and gain access to private keys. CoinDesk said the flaw remained undiscovered for years even though the source code was public, as reviewers failed to verify which random number generator was actually used in seed creation. Coldcard has now distributed patched firmware, but said seeds created under the vulnerable firmware cannot be protected through an update alone and users should generate new seeds and move their BTC to new addresses.