Bitcoin ecosystem security vulnerabilities

The Bitcoin ecosystem has faced significant security challenges stemming from widespread vulnerabilities in software and hardware. Initial research identified nearly 5,000 high-risk or critical flaws across various applications, including wallets, node software, mining pools, and exchanges. A notable weakness was found in the CryptoJS JavaScript library, which resulted in millions of dollars in losses.

A critical focus of these security concerns involves entropy failures in hardware wallets. Specifically, a firmware error in Coldcard devices was found to have used a predictable pseudo-random number generator instead of a true random number generator during seed creation. This flaw allowed attackers to reconstruct seeds, leading to the theft of up to 2,055 BTC, valued between $70 million and $130 million.

In response, manufacturers have issued emergency firmware updates, and industry leaders are calling for mandatory independent entropy testing for all hardware wallet providers following the discovery of further entropy-handling failures through AI-assisted security audits.