A firmware vulnerability in Coldcard hardware wallets enabled an attacker to steal approximately $70.2 million in Bitcoin (1,082.65 BTC) from 1,196 addresses in just 41 minutes on July 30. Galaxy Research traced the exploit to a March 2021 firmware integration error that caused seed generation to rely on a predictable software pseudorandom number generator instead of secure random generation. The
An attacker drained 1,196 Bitcoin addresses in 41 minutes on July 30, taking 1,082.65 BTC worth about $70.2 million at the time. Galaxy Research mapped the sweep and tied it to a firmware flaw in Coldcard, the Bitcoin-only hardware wallet made by Canadian firm Coinkite. A March 2021 firmware integration error routed seed generation to a deterministic software pseudorandom number generator (PRNG
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
