Coldcard hardware wallet flaw leads to $130 million Bitcoin theft
A firmware change introduced in March 2021 altered the Coldcard hardware wallet’s seed‑generation process, routing entropy to a software fallback instead of the device’s hardware random‑number generator. The resulting seeds contained only about 40 bits of entropy, making private keys recoverable offline. Researchers at Galaxy Research identified at least 15 distinct attackers exploiting the flaw. Three confirmed attack waves have stolen roughly 1,596 BTC (about $100 million) from around 7,300 addresses, and a suspected fourth wave could raise the total to 2,055 BTC (approximately $130 million). The breach has affected over 7,700 Bitcoin addresses, with losses estimated at $130 million. Canadian Bitcoin holders bear about 25 % of the damage. Coinkite’s co‑founder and CTO Peter Gray has been linked to the faulty randomness code, and AI‑assisted code reviews failed to detect the vulnerability before it was exploited. Coinkite has urged users to regenerate seeds and move funds to new wallets, while the broader hardware‑wallet industry is reassessing security practices.
Entities: Alex Thorn · Bitcoin · Coinkite · Coinkite Ltd. · Coldcard · Coldcard hardware wallet · Galaxy Research · Peter Gray · Rodolfo Novak
Claims
What the coverage asserts, and how well corroborated each claim is across sources.
- [○ 1 SOURCE] Canadian Bitcoin holders account for roughly 25 % of the total Coldcard losses. (Coldcard hardware wallet flaw leads to $130 million Bitcoin theft)
- [○ 1 SOURCE] Coinkite co‑founder and CTO Peter Gray is linked to the faulty randomness code used in Coldcard firmware. (Coldcard hardware wallet flaw leads to $130 million Bitcoin theft)
- [● 7 SOURCES] Attackers exploited the vulnerability to steal between $100 million and $130 million worth of Bitcoin. (Coldcard hardware wallet flaw leads to $130 million Bitcoin theft)
- [● 2 SOURCES] More than 15 distinct attackers have been identified exploiting the Coldcard flaw. (Coldcard hardware wallet flaw leads to $130 million Bitcoin theft)
- [● 6 SOURCES] Three confirmed attack waves stole 1,596 BTC from about 7,300 Bitcoin addresses. (Coldcard hardware wallet flaw leads to $130 million Bitcoin theft)
- [● 7 SOURCES] Coldcard firmware introduced in March 2021 reduced seed‑generation entropy to about 40 bits. (Coldcard hardware wallet flaw leads to $130 million Bitcoin theft)
- [● 6 SOURCES] A suspected fourth wave could raise total stolen to 2,055 BTC, valued at roughly $130 million. (Coldcard hardware wallet flaw leads to $130 million Bitcoin theft)
- [● 2 SOURCES] AI‑assisted code reviews failed to detect the Coldcard vulnerability. (Coldcard hardware wallet flaw leads to $130 million Bitcoin theft)