Bitcoin
Coldcard Patches Critical Wallet Seed Flaw
Coinkite released firmware updates to address a randomness vulnerability that led to $130 million in Bitcoin theft from its hardware wallets.
Coldcard maker Coinkite has released a security update following a seed-generation flaw that allowed attackers to drain Bitcoin from air-gapped devices. The company rolled out firmware 5.6.1 for Mk4 and Mk5 models and version 1.5.1Q for its Coldcard Q device, following a three-week internal review conducted with external security researchers.
The vulnerability, dating to 2021, generated some wallet seeds with insufficient randomness, making private keys easier to guess. In July, attackers exploited this flaw in successive waves. The first attack drained 594 BTC—then worth about $38 million—from roughly 500 wallets in 25 minutes. Galaxy Research subsequently tracked losses that reached more than $112 million by mid-August, with attackers stealing approximately 1,778 BTC across multiple coordinated incidents.
Coinkite said the flaw reduced entropy on affected devices from 128 bits to roughly 40 bits, compromising wallet security without requiring physical access. The updated firmware now requires users to supply their own randomness during wallet seed generation through key presses, dice rolls, or coin flips, which the device combines with its internal randomness source. Coinkite also replaced its backup random number generator, added hardware checks, and patched additional issues affecting transaction signing, USB data handling, and firmware validation.
Coinkite suggested that attackers may have used artificial intelligence to examine its open-source firmware and uncover the flaw.
These two are not the same thing, and one does not produce the other. The left is how this single article reads, from its tone alone. The right is the site’s own call on the asset, from indicators and analysis. Press tone feeds no score and no signal: on the only corpus this site has measured, daily tone tracked the move that had already happened and showed no measurable link with what followed.
More on Bitcoin All pieces →
- Neutral Block Files for US National Trust Bank Charter to Consolidate Crypto Custody
- Neutral Tokenized Asset Holders Cross 3.5 Million as Institutional Inflows Rebound
- Neutral Iran Eases Currency Restrictions to Permit Cross-Border Crypto Settlements
- Neutral Block Seeks OCC Approval for Builders Bank & Trust to Manage Digital Assets
Rewritten from the headline, the teaser and the one-line summary the qualification step produced — that is all the material there is, and nothing is added to it. The source link is kept on file so any item can be checked, and is not published here.
