Firmware update addresses seed-generation vulnerability that enabled attackers to steal over $100 million in Bitcoin since July.
Coldcard manufacturer Coinkite released updated firmware for its hardware wallets after a flaw in seed generation led to over $130 million in Bitcoin thefts. The vulnerability, present since 2021, allowed attackers to exploit insufficient randomness in wallet seeds, making private keys easier to guess.
The first major attack in July drained 594 BTC, valued at $38 million, from approximately 500 wallets within 25 minutes. A three-week security review involving external researchers and AI models identified additional issues in transaction signing, USB connections, and backups.
Users of Coldcard Mk4, Mk5, and Q models are urged to upgrade to firmware versions 5.6.1 or 1.5.1Q. The new release requires manual randomness input, such as key presses or dice rolls, during seed generation to enhance security.