Hackers stole at least $89 million in cryptocurrency from Coldcard hardware wallets by exploiting a weak random number generation algorithm. Coinkite CEO Rodolfo Novak warned that AI-assisted code review is accelerating attacks on firmware.
Hackers have stolen approximately $130 million in cryptocurrency from offline Coldcard hardware wallets by exploiting a vulnerability in seed phrase generation.
Hardware wallet manufacturers Trezor and Foundation warn of surging phishing attempts exploiting the Coldcard firmware vulnerability, as scammers target recovery phrases and push malicious downloads following significant crypto thefts.
Coldcard's newly disclosed random-number generator bug allowed an attacker to rebuild Bitcoin wallet seeds, leading to potential theft. The flaw, present in firmware versions 4.0.0 to 4.1.9 for Mk2/Mk3 and pre-5.6.0/6.6.0X for Mk4/Mk5/Q, highlights that seed randomness is crucial before air-gapping.
Coldcard users face a new wave of coordinated Bitcoin thefts, with Galaxy's Alex Thorn flagging 709 affected addresses and 448.7 BTC moved. This follows a disclosed firmware flaw causing compromised wallet seeds, with total losses now estimated over $90 million.
A five-year-old seed-generation flaw in Coldcard hardware wallets, which inadvertently used a weaker random number generator, has led to nearly $90 million in Bitcoin being drained from over 4,500 addresses. Kraken CSO Nick Percoco highlights this as a critical weakness in hardware wallet independent testing, urging for verification of randomness sources.
Binance founder Changpeng "CZ" Zhao warned crypto owners about hardware wallet vulnerabilities after a Coldcard exploit drained over $70 million in Bitcoin. A flaw in firmware shipped in March 2021 allowed private keys to be guessed, affecting 1,196 addresses, prompting Coinkite to issue hotfixes.
Trezor has revealed a vulnerability in its Safe 7 hardware wallet, discovered by Ledger Donjon. The exploit, a laser fault injection attack on the TROPIC01 chip, reduces PIN protection layers but requires physical access and specialized equipment, leaving user funds protected.
Marlon Ferro, aka “GothFerrari,” broke into victims’ homes to steal hardware wallets when his co-conspirators couldn’t hack them remotely.
‘GothFerrari’ was sentenced for his part in a criminal enterprise that stole crypto through social engineering and physical break-ins.
