Play store
A major security flaw in the popular Coldcard hardware wallet has been linked to one of the largest recent cryptocurrency thefts, with hackers stealing tens of millions of dollars’ worth of Bitcoin from more than 1,000 wallets in less than an hour.
According to recent international media investigations, cybercriminals stole nearly $70.2 million worth of Bitcoin from 1,196 cryptocurrency wallets within just 41 minutes. Earlier reports had indicated that 584 Bitcoin, valued at approximately $38 million, had been stolen from 500 wallets during a 25-minute attack.
The breach has been traced to a critical vulnerability in the Coldcard hardware wallet, developed by Canadian company Coinkite. All affected wallets reportedly contained at least 0.15 Bitcoin and were configured as single-signature wallets.
A Bitcoin engineering and security team at Block found that the issue stemmed from the way Coldcard generated wallet seed phrases—the secret recovery words that protect cryptocurrency wallets.
Instead of relying entirely on a secure hardware-based random number generator, Coldcard’s firmware reportedly used a weaker software algorithm known as Yasmarang, part of the MicroPython framework. Researchers say attackers were able to predict these values offline, allowing them to reconstruct seed phrases and gain unauthorized access to users’ Bitcoin holdings.
Coldcard is designed to store Bitcoin offline, keeping digital assets isolated from the internet for enhanced security. However, users of older models—including the MK2, MK3, MK4, Q, and MK5—have reportedly been affected by the vulnerability.
Coinkite said its newer hardware models are not vulnerable to the flaw. Although firmware updates have been released for older devices, wallets created before the update may still remain at risk. The company has advised users to update their firmware and create entirely new wallets with fresh seed phrases.
The incident adds to growing concerns over cryptocurrency security. Industry data show that nearly $1 billion worth of digital assets was stolen during the first half of the year, underscoring the persistent cybersecurity challenges facing the crypto sector despite the widespread use of hardware wallets.