Bitcoin hardware wallet breaches result in over $240 million in losses

Major security breaches involving Bitcoin hardware wallets have resulted in estimated losses exceeding $240 million. Two distinct types of failures were identified: a firmware vulnerability and a supply-chain attack.

A flaw in Coinkite’s Coldcard firmware, affecting builds from March 2021 onward, weakened the randomness used to generate seed phrases. This allowed attackers to recreate private keys and drain an estimated 1,800+ BTC, valued between $100 million and $150 million, without physical access to the devices.

Separately, a supply-chain attack targeted Ledger Nano X and Nano S Plus units sold through the authorized reseller CryptoBilis. These specific batches contained hidden implants that compromised users’ seed phrases, leading to losses estimated between $90 million and $100 million.

These incidents have sparked a debate among industry executives regarding the future of self-custody. While some argue that Bitcoin custody requires technical expertise similar to early computing, others suggest that making self-custody more user-friendly through methods like multisignature wallets or seedless backups is essential for broader adoption.