Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes

A significant Bitcoin theft occurred on July 30, with an attacker draining 1,196 Bitcoin addresses in just 41 minutes and stealing approximately $70.2 million worth of Bitcoin. The stolen amount totaled 1,082.65 BTC. Researchers at Galaxy Research have linked the theft to a flaw in the Coldcard hardware wallet, which is a Bitcoin-only wallet made by Coinkite, a Canadian company. The issue is attributed to a firmware integration error that occurred in March 2021, specifically a problem with the seed generation process. This error caused the seed generation to be routed to a deterministic software pseudorandom number generator. The flaw in the Coldcard wallet's firmware ultimately enabled the rapid theft of a large amount of Bitcoin.