Coldcard Firmware Flaw Lets Attackers Drain 594 Bitcoin From Self-Custody Wallets

A software defect in the Coldcard Mk3, one of the most widely used bitcoin hardware wallets, allowed attackers to reconstruct users' private keys and move funds without ever touching the physical device. CoinDesk reported that roughly 594 bitcoin, worth about $38 million, was drained across roughly 500 devices, with much of the theft carried out within about 25 minutes.

The root cause was weak randomness in key generation. Instead of relying on the chip's hardware random number generator, affected firmware derived seed material from weaker inputs tied to the device serial number and an internal counter, making the resulting seed phrases guessable. The flaw was present in Mk3 units running firmware 4.0.1 or later, dating to March 2021, which is why the drained wallets were overwhelmingly older, single-signature addresses that had sat untouched for years. Coinkite, the manufacturer, has released fixed firmware and urged owners of at-risk models to move coins to freshly generated keys immediately. Bitcoin Magazine put the total value exposed at more than $70 million once vulnerable but not-yet-drained balances are counted.

The disclosure carries a second, unusual detail. Coinkite founder Rodolfo Novak said an artificial-intelligence-assisted code review appears to have identified the latent bug, and researchers believe the attacker may have used the same class of tooling to find and exploit it at scale. Rival manufacturer Blockstream said its Jade device is unaffected because it generates keys differently. The stolen funds were consolidated into a small number of addresses and have not moved, and no recovery or attribution has been confirmed.