#Coldcard Mnemonic Flaw Leads to BTC Theft

Coldcard issues Mk3 seed warning after 594 BTC theft raises security concerns Coinkite warned that wallets created on Coldcard Mk3 devices running firmware versions 4.0.1 through 5.0.3 may be at risk due to a seed generation flaw. Users are advised to migrate funds immediately. The warning comes as investigators continue probing the recent theft of 594 BTC from hundreds of single-signature wallets, though no evidence has confirmed a link between the two incidents.

English translation unavailable

THIS IS INSANE. $40,000,000 in $BTC was stolen because of the Coldcard wallet vulnerability. The attacker exploited a flaw in Coldcard's key generation and stole these funds within 25 minutes. Even cold wallets aren't safe now. https://t.co/vULxlMzJ26

This is worse than any previous Bitcoin exchange hack. It is arguably one of the worst things that could happen. The popular hardware wallet COLDCARD has a faulty random number generator (RNG). Funds are being drained from ordinary users’ hardware wallets as you read this. Users first reported to Block less than 24 hours ago that funds were moving out of their wallets. The exploit was most likely discovered with the help of AI. Block has confirmed that the RNG is broken. You know what that means. There are likely already multiple attackers competing for the affected BTC. Many more will join very soon. Nobody knows how much BTC is affected. Nobody knows how many users are affected. This attack has only just begun, and it will continue until all affected BTC has been drained unless users secure their funds first. Inevitably, many Bitcoiners will not hear about the incident early enough to respond in time. I am truly saddened for everyone affected, especially those who may have just lost their life savings. The worst part is that they did everything right.

Coldcard has disclosed a vulnerability in how their devices generate random numbers for seeds, and outside researchers have corroborated the issue. While the issue originated in Coldcard’s firmware and not Unchained tech stack, at this time, and out of an abundance of caution, our recommendation is to rotate any Coldcard-generated key to a key generated on a different device. This issue is most severe if you use two Coldcard-generated keys for your Unchained 2-of-3 multisig vault. Within any standard 2-of-3 configuration, if only one key is compromised, funds are generally considered safe. However, clients should still replace their key as soon as practicable. Moving too quickly or panicking can lead to mistakes. Scammers target people who are fearful. When communicating with our team, always verify your Unchained representative using Support PINs: https://t.co/stNEGfqfWA