Breaking Lab srl
A Hidden Bug, Four Years in the Making
In the world of cryptocurrency security, hardware wallets have long been considered the gold standard — physical devices designed to keep private keys completely isolated from internet-connected systems. For years, the Coldcard wallet, produced by Canadian firm Coinkite, was regarded as one of the most security-conscious options available to Bitcoin holders. That reputation has now taken a severe blow following the discovery of a firmware flaw that researchers believe enabled one of the most devastating targeted Bitcoin thefts on record.
According to an analysis by Galaxy Research, a vulnerability introduced into Coldcard’s firmware in March 2021 quietly routed the wallet’s seed generation process to a deterministic software pseudorandom number generator (PRNG) rather than a truly unpredictable hardware entropy source. The consequence was catastrophic: wallets created with the affected firmware versions produced private keys that, while appearing random to the end user, could potentially be reproduced or predicted by an attacker with knowledge of the flaw.
Forty-One Minutes to Drain 1,196 Wallets
The attack, which took place on July 30, demonstrated a level of surgical precision that underscores just how thoroughly the vulnerability had been mapped and weaponised. In just 41 minutes, an attacker systematically swept 1,196 Bitcoin addresses, walking away with 1,082.65 BTC — valued at approximately $70.2 million at the time of the theft. The speed of the operation suggests extensive preparation: the attacker likely spent significant time identifying affected wallets before executing the sweep in a single, coordinated burst.
Galaxy Research’s blockchain forensic work traced the common thread linking the drained addresses back to the specific firmware versions that contained the flawed PRNG implementation. The deterministic nature of the compromised seed generation meant that, given the right parameters, a bad actor could reconstruct the private keys of any wallet generated during the vulnerability window — without ever physically accessing the device.
What Went Wrong Inside Coldcard’s Firmware
Hardware security devices depend on genuine randomness when generating cryptographic keys. If the source of that randomness is predictable — even slightly — the mathematical guarantees that underpin public-key cryptography begin to unravel. In Coldcard’s case, the integration error meant that the PRNG seeding process lacked the unpredictability that users reasonably expected from a dedicated hardware security module. This type of vulnerability is notoriously difficult to detect through normal usage: the wallet appears to function perfectly, generates addresses, signs transactions, and returns no errors. The flaw is entirely invisible until an attacker who knows it exists decides to act.
Coinkite has not yet issued a comprehensive public postmortem at the time of writing, though the severity of the incident has prompted urgent discussion within the Bitcoin security community about firmware auditing practices and the transparency obligations of hardware wallet manufacturers.
What Affected Users Should Do Now
For anyone who set up a Coldcard wallet during or after March 2021, the immediate priority is to determine which firmware version was used at the time of wallet creation — not the current firmware, but the version active when the seed phrase was first generated. If there is any uncertainty, security researchers are strongly advising users to migrate funds to a freshly generated wallet created on verified, unaffected hardware or software. Simply updating the firmware on an existing Coldcard will not resolve the exposure, because the compromised seed phrase was already generated under the flawed conditions.
A Warning Shot for the Hardware Wallet Industry
This incident carries implications that extend well beyond Coldcard and its user base. Hardware wallets occupy a uniquely trusted position in the cryptocurrency ecosystem — they are purchased precisely because users want to remove software vulnerabilities and internet exposure from the equation. When the hardware itself harbours a cryptographic flaw, the entire security model collapses silently. The $70 million theft is a stark reminder that open-source firmware auditing, independent third-party security reviews, and rapid, transparent disclosure of vulnerabilities are not optional extras for companies in this space — they are fundamental obligations to the people trusting them with life-changing sums of money. As Bitcoin’s value continues to grow, the incentive for attackers to hunt for exactly these kinds of dormant, high-yield vulnerabilities will only intensify.
