Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes

Summary: An attacker drained 1,196 Bitcoin addresses in 41 minutes on July 30, taking 1,082.65 BTC worth about $70.2 million, in a sweep Galaxy Research tied to a Coldcard firmware flaw. A March 2021 integration error routed seed generation to a deterministic software pseudorandom number generator instead of the STM32 hardware RNG, and Coinkite shipped emergency firmware on July 31 that does not repair existing seeds.
What you should know: Coinkite estimates effective entropy at roughly 40 bits on the Mk3 and about 72 bits on later models against 128 bits for a 12-word BIP-39 seed, so any wallet whose seed was generated on affected firmware remains exposed until the coins are moved to a newly generated seed. Galaxy has since raised its observed estimate to 1,367.05 BTC, about $88.6 million across 4,585 addresses, and says the activity is ongoing.

Read the original at The Hacker News ↗