Hardware wallets are generally considered the safest way to store cryptocurrency, but that didn't save Coldcard owners. Due to a bug in older firmware, hackers were able to brute-force a portion of seed phrases and drain up to $88.6 million in BTC from wallets.
The issue originated back in 2021. When generating a new wallet, certain devices produced insufficiently random seed phrases. This proved enough for attackers to brute-force possible combinations, identify matching Bitcoin addresses, and gradually drain funds from them.
According to Galaxy Research, the attack occurred in several stages. Over 4,500 wallets were affected in total, with damages estimated between $86–88.6 million.
Coinkite has already rolled out firmware updates for the Mk3, Mk4, Mk5, and Q models. However, there is one major caveat: if a seed phrase was generated on a vulnerable firmware version, a standard update will not resolve the issue.
As a result, owners of affected wallets are advised not to stop at installing the new firmware, but to create an entirely new wallet with a new seed phrase and transfer all funds to it. Otherwise, the risk persists even after updating.
