Critical Security Flaw Found in COLDCARD Hardware Wallets
Software bug linked to theft of 594 BTC puts users at immediate risk, urgent updates required.
1Critical Security Vulnerability Discovered
A serious flaw was found in COLDCARD hardware wallets' random number generation during seed phrase creation. Mk3 models with firmware 4.0.1 or later are at direct risk. The issue stems from insufficient entropy from the hardware random number generator. Coinkite, the manufacturer, issued an urgent security advisory warning users about potential fund losses.
2594 BTC Stolen in Related Attacks
Approximately 594 BTC (worth $40 million) was stolen in attacks possibly exploiting this vulnerability. Hackers reportedly transferred funds from compromised wallets. Coinkite launched a comprehensive investigation following the incident. The company shared preliminary findings about how the attacks might have been executed.
3Affected Models and Risk Levels
Mk3 wallets created with firmware 4.0.1 or later are directly vulnerable. Mk4, Mk5 and Q models remain unaffected. However, wallets generated with older firmware versions may carry low-level risks. Users who performed 50+ dice rolls during initial setup are relatively safer as they provided additional entropy.
4Potential AI Involvement
Coinkite suggested sophisticated AI algorithms might have been used to exploit the vulnerability. The open-source nature of COLDCARD firmware made it possible for threat actors to use advanced AI tools to find vulnerabilities traditional reviews missed. Ironically, Coinkite had recently audited its code using a popular AI model but failed to detect this flaw.
5Emergency Firmware Updates Released
Coinkite rushed firmware updates 5.6.0 for Mk4/Mk5 and 1.5.0Q for Q devices. However, the company clarified these updates won't fix wallets already created via previous hard forks. Users must generate new seed phrases and transfer funds to new wallets. The migration process requires careful execution to avoid potential pitfalls.
6Immediate User Actions Required
Affected users must immediately update firmware, generate new seed phrases, and transfer funds to new wallets. Coinkite warns about the importance of careful migration. Additional security measures during wallet setup, like extra dice rolls, are strongly recommended to enhance entropy and security.
7Recent Crypto Security Incidents
This incident follows other major security breaches in crypto. Last week, South Korea uncovered a $9M XRP scam involving fake staking. The $11.6M Verus Bridge hack exploited a minor cross-chain flaw. The COLDCARD vulnerability raises new questions about hardware wallet reliability and the evolving nature of crypto threats.
8Lessons for Crypto Security
This event underscores the need for multi-layered security in crypto storage solutions. While hardware wallets remain among the safest options, software-based vulnerabilities can create critical risks. Regular updates and multi-factor authentication are becoming essential practices for all crypto users in this evolving threat landscape.
Original article: CryptoNinjas — COLDCARD Cüzdanlarında Kritik Güvenlik Açığı