Coldcard cold wallet suffers breach, random number vulnerability leads to $114 million in BTC stolen

Original by Odaily Planet Daily (@OdailyChina)

Author: Wenser (@wenser 2010 )

The "signature event" of every bear market—hacker attacks—has arrived once again, right on schedule. This time, the target is the supposedly impenetrable "safe haven for funds": the Coldcard hardware wallet.

According to the latest information provided by Galaxy Research Head of Research Alex Thorn, a new wave of Bitcoin sweeping attacks targeting Coldcard wallet addresses is underway, with cumulative losses from Coldcard hardware wallet vulnerabilities potentially reaching nearly $114 million. The only silver lining is that this attack primarily affects single-signature wallets; multi-signature wallets have not yet been swept into the vortex.

A BTC theft of this magnitude casts yet another heavy shadow over an already beleaguered crypto market. Is security a matter of faith, or an illusion? The answer is growing ever more sobering.

A Hidden 5-Year-Old Vulnerability, or Exploitation of Weak Mnemonic Generation?

The theft of cold wallet funds that began on July 31 initially involved only about 500 addresses, but as hackers launched four consecutive waves of sweeping attacks, the number of affected addresses quickly surpassed 4,500, and the scale of losses surged from $40 million to $114 million.

This is not the first time Coldcard has experienced technical vulnerabilities; as early as six years ago, firmware flaws were exposed.

Coldcard's Historical Baggage: The 2020 Firmware Defect Vulnerability

In May 2020, researchers at well-known hardware wallet maker Ledger demonstrated that attacks could be carried out against products from hardware wallet manufacturers Coinkite and Shapeshift, potentially allowing attackers to discover the PIN codes protecting these wallets. Although the vulnerability was quickly patched, and both attacks required physical access to the device—minimizing the danger—Ledger maintained that upholding the highest standards for hardware wallets was essential.

At the time, Ledger's CTO and head of the Donjon security team, Charles Guillmet, stated: "If you want, you can put millions or even billions of dollars in a hardware wallet. So if an attacker can get physical access to the hardware wallet, and the wallet is not secure, that is absolutely a big deal. Some cryptocurrency exchanges even use hardware wallets for cold storage."

It's worth noting that the vulnerability at the time was in the Mk2 wallet (a hardware flaw) from Coinkite, Coldcard's developer. The company then claimed the issue had been fixed in its latest product, the Mk3 wallet. Interestingly, the cold wallets involved in this theft of over 1,360 BTC are precisely the Mk3 devices. Coldcard later alsoreleased Beta firmware patches to fix other vulnerabilities, but this did little to prevent today's security incident.

The Coldcard BTC Theft Case: From 500 Addresses to Over 4,500 Addresses, Losses Approach $114 Million

On July 31, Bitcoin News monitoring showed that approximately 594 BTC (worth about $38 million) had been transferred from 500 Coldcard cold wallet addresses and consolidated into another wallet, bc1qnk. The common characteristics of the affected addresses: all used single-signature addresses, with balances ranging from approximately 0.15 to 0.26 BTC, and many UTXOs had been dormant for years.

Following the news, Coldcard CEO NVK initially denied the existence of a device-wide vulnerability, suggesting that affected users may have imported previously compromised or weakened seeds, and noted that the transfers involved keys from various wallets. Jameson Lopp reported that another victim lost only a portion of their UTXOs, not the entire wallet balance, which may indicate exposure of individual private keys rather than a full seed leak.

However, as attackers continued to launch second and third waves of sweeping attacks, the primary issue was ultimately pinpointed to the Coldcard hardware wallet.

Coldcard MK3 Vulnerability Reproduced; Official Warns Users to Transfer Funds Amid Ongoing Second and Third Attack Waves

On July 31, Bitcoin Core developer instagibbs stated that on a newly initialized COLDCARD MK3 device, using only the number of button presses during the setup process, he successfully reproduced the reported COLDCARD vulnerability, adding, "Sorry, it's time to panic."

Coinkite officially followed up with a statement, warning Coldcard Mk3 signing device users to migrate funds from wallets whose mnemonics were generated by affected firmware. They stated that mnemonics generated by Mk3 firmware version 4.0.1 and later, released in March 2021, may put funds at risk, with the impact extending to version 5.0.3, the final version supporting the Mk3. Mk4, Q, and Mk5 models are not affected.

On August 2, Galaxy Research announced that attacks targeting Coldcard-generated wallets with weak random numbers were still ongoing, urging users to immediately migrate funds from affected Coldcard single-signature wallets to secure addresses. According to on-chain tracking data, the Coldcard wallet attack incident currently involves approximately 1,367.05 BTC, worth about $88.6 million, across 4,585 addresses.

Weak Random Number Issue in Wallet Implementation; "High-Value Wallet Targeting" and "Copycat Attacks" Emerge

Amid the public outcry, Coldcard developer Coinkite—a hardware wallet maker with just five employees—could no longer remain silent and began releasing phased investigation findings.

Coinkite: Mnemonic Generation Vulnerability Stems from Wallet Implementation, Not a Bitcoin Cryptography Flaw

On July 31, Coinkite officially stated that the problem did not lie in Bitcoin's cryptography itself, but rather in the way COLDCARD generates wallet mnemonics. During the libNgU migration in March 2021, the wallet inadvertently used a weaker software random number generator when creating new mnemonic phrases, rather than the device's dedicated hardware random number generator. This reduced the randomness protection for some wallets, making certain mnemonics easier to guess than intended.

The vulnerability has affected mnemonic generation since March 2021, with Mk3 devices being the most severely impacted. The Mk4, Q, and Mk5 models incorporated additional hardware-generated randomness, providing stronger protection, though they still rely on the same software component afterward. The company stated the error occurred because two pieces of software used the same function name, causing the wrong function to be selected during the build process without triggering an error. Coinkite has since changed its build process to prevent this from happening again.

A new technical analysis by Core-Lightning developer ddustin also suggests that the 2021 COLDCARD vulnerability may have originated from a compiler error triggered by developer-related security code. He further emphasized: "Developers should not release security-critical code they do not fully understand, especially when it is safeguarding billions of dollars in Bitcoin."

Analysis of the Coldcard Theft Attack: Targeting High-Value Wallets and the Emergence of "Copycat Attacks"

As more third-party organizations followed up, further details of the Coldcard cold wallet theft have come to light.

In summary, the attackers were organized and premeditated, prioritizing "wealthy" targets, and subsequently, many individuals began "copycat operations," draining funds from Coldcard wallets.

Chainalysis stated that analysis of the over $38 million Coldcard exploit revealed that attackers deliberately targeted the highest-value wallets first, including one holding $1.8 million, indicating that victims were profiled before the asset transfers began. Approximately $30 million was stolen within the first 10 minutes, followed by roughly 500 wallets being drained within 25 minutes.

Investigators also confirmed that the attackers used a paid account with a well-known blockchain service provider to query victim addresses during the operation. The provider's internal logs matched the timing and sequence of requests, but no evidence was found indicating the company knowingly assisted in the theft.

Galaxy Research Head of Research Alex Thorn stated in a post that the attacks surrounding Coldcard wallets continue to evolve, with more small-scale attackers and imitators now targeting the remaining Coldcard mnemonics. He noted that through assistance efforts, he had confirmed the identity of one depositor involved in the attack, whose funds were transferred out before they could be frozen on the Duel platform—and the funds involved did not belong to the three major attack waves previously identified by Galaxy Research.

Fallout from the Coldcard Incident: Coinkite Faces Potential Class Action; Chinese Open-Source AI Model "Comes to the Rescue"

The hackers remain at large, while Coldcard developer Coinkite has been thrust into the center of a public storm, potentially facing legal action from users.

Thomas Braziel, founder and managing partner of 117 Partners, is researching product liability claims and class action lawsuits against Coinkite and is coordinating the collection of information from international victims. Brazilian Bitcoin supporter Felipe Ojeda has filed a police report and will file a complaint against the company in Brazil.

However, some have raised objections. ATH21 CEO Cris Carrascosa stated that Coinkite does not bear custodial responsibility for its product users' funds, and any lawsuit would need to prove that Coldcard could have foreseen this attack. Blend Head of Institutional Business Development Ana Ojeda noted that victims do not have an automatic right to full recovery of funds, but investigations into liability can proceed.

In response to the matter, Bloomberg Senior ETF Analyst Eric Balchunas posted a sharp critique, questioning whether a company of roughly five people is suitable to bear such critical Bitcoin storage responsibilities, saying the headcount behind Coldcard "seems incredibly low." "If a bank had only 5 employees and was headquartered in Canada, would people willingly deposit their life savings there? In the crypto industry, this might be viewed as a feature, but from a traditional finance perspective, it becomes an obvious red flag."

Unfortunately, it is only when risks materialize into real danger that people suddenly realize they had entrusted their life's savings to a cold wallet developer that appeared to be an established industry player but was, in reality, a makeshift operation. Regret comes too late.

Notably, during this security investigation, a Chinese open-source AI model also had its moment to shine.

Yesterday, Galaxy Research Head of Research Alex Thorn posted that during this investigation, some US-based AI large language models restricted researchers' ability to track stolen funds, forcing the team to turn to a Chinese open-source AI model to assist in protecting user assets and conducting on-chain tracing. He called the phenomenon "unbelievable" and plans to push for discussions on the issue at both governmental and industry levels.

Avoid Complacency: Transfer Funds Immediately

Bitcoin hardware wallet manufacturer Coldcard stated in a post that its team has been continuously contacting customers since last Friday to assist in transferring still-safe funds and providing recovery guidance. The company has now destroyed remaining COLDCARD inventory produced with the vulnerable firmware and suspended shipments; Satscard, Opendime, and Tapsigner are not affected; the released patched firmware prevents newly generated mnemonics from being affected, but old mnemonics generated on vulnerable firmware remain at risk—users must create new wallets and transfer funds. The official recommendation suggests considering alternatives such as Bitkey, Ledger, Trezor, Jade, and Bitbox in the interim, and urges affected users to retain their devices to assist with subsequent recovery efforts.

To conclude this article, Odaily Planet Daily has also compiled perspectives from industry experts and cold wallet users for reference:

First, mnemonics should be protected with a Passphrase. SlowMist founder Cos Sin previously stated in a post that in the COLDCARD hardware wallet weak randomness security incident, using a Passphrase with the mnemonic would have avoided this attack. The Passphrase is not the wallet's unlock PIN, but a dedicated password set for the mnemonic, a mechanism supported by all mainstream hardware wallets. It's worth noting that the Passphrase must be sufficiently long, random, and unique, and stored separately from the mnemonic; recovery testing is mandatory after setup, as any typo will generate another seemingly normal but entirely different wallet.

Second, set up multi-signature wallets to protect large assets. Whenever and wherever, multi-signature wallets are the last line of defense for asset protection. In the previous Bybit $1.5 billion theft and the Humanity $36 million theft, too few multi-signature settings also gave attackers an opening. For cold wallets used for long-term Bitcoin accumulation or crypto asset inheritance, multi-signature setup is not an option—it is a must.

Third, pay attention to the source and usage process of cold wallets. Cold wallets must be purchased from official websites; do not trust various e-commerce platforms or second-hand trading platforms; perform device anti-counterfeiting verification; mnemonics should be generated through your own independent operation—do not completely delegate the security of your cold wallet to the wallet's random number generator.

In any case, the crypto wealth you have accumulated through countless bull and bear markets and countless days and nights of effort deserves robust security protection. Do not assume that a cold wallet is an absolutely secure "fund refuge."

A cold wallet that looks like a secure lock can sometimes be a ticking time bomb