Nearly 1,400 Bitcoin Hacked from Coldcard Wallets

In the middle of the night on July 30, $70.2 million worth of Bitcoin were stolen from addresses created by hardware wallet manufacturer Coinkite's Coincard products. A firmware bug weakened the recovery phrases generated by several generations of their devices, allowing an attacker to reconstruct their users' private keys without physical access to the devices.

According to an analysis by Galaxy Research, over 1,082 coins were stolen between 1:10 AM and 1:51 AM UTC on July 30 from more than a thousand individual cryptocurrency addresses, about 30 hours before Coldcard published its first security advisory to their customers.

In the days since, this number has grown to nearly 1,400 Bitcoin, likely as other opportunistic hackers have begun searching for vulnerable wallets.

The incident did not involve a weakness in Bitcoin’s cryptography. Instead, a programming error caused affected Coldcard firmware to generate wallet seeds with far less randomness than intended.

Predictable recovery phrases

When a user creates a Bitcoin wallet, the device generates a random seed and converts it into a recovery phrase. That seed is the source of the wallet's private keys. Anyone who discovers it can recreate the wallet and spend its funds.

Coldcard was theoretically designed to generate seeds with at least 128 bits of entropy, making it effectively impossible to search every possible seed.

The bug occurred when the firmware failed to use the device's hardware random number generator during this process, and used a non-secure software fallback instead.

As a result Coinkite, the company behind Coldcard, says affected Mk2 and Mk3 firmware may have produced seeds with only about 40 bits of entropy. Affected Mk4, Mk5, and Q devices may have generated seeds with about 72 bits.

With the number of possible seeds dramatically reduced, an attacker could generate candidate recovery phrases, derive their corresponding Bitcoin addresses, and compare them against addresses visible on the public blockchain to check their balances. Eventually, they'd transfer those balances to an attacker-controlled wallet.

The attacker did not need the physical wallet, its PIN, access to the owner's computer, or a copy of the recovery phrase.

Multiple Coldcard generations are affected

Coldcard's security advisory states that the Coldcard Mk2, Mk3, Mk4, Mk5, and Q are all impacted. They have released a firmware update which fixes this problem when generating new keys, which they encourage users to install immediately.

However, while updating the device should prevent it from creating another weak seed, it does not repair an existing one. Users need to check which firmware was installed when their wallet seed was created, not only which version is installed now.

Coinkite claims Tapsigner, Opendime, and Satscard are not affected because they use different codebases.

What users need to do

Coldcard users are urged to immediately transfer their funds to a cryptocurrency wallet unaffected by this issue, then update their devices to the latest firmware as soon as possible.

Do not restore your old, existing seed phrase on an updated Coldcard device or a different hardware or software wallet. The vulnerability partly lies in the seed phrase itself, so reusing that seed preserves the weakness no matter which device it is used on.

Wallet owners should expect phishing attempts related to the incident. A firmware update or wallet migration should never require entering a recovery phrase into a website. Users should also verify receiving addresses carefully rather than rushing the transfer.

Coldcard allows users to add physical dice rolls while generating a wallet. Coinkite says at least 50 fair, independent, and privately recorded rolls should provide 128 bits of entropy from the dice alone.

Anyone who didn't do this, used fewer than 50 rolls, or cannot remember how many they used, should migrate to a new seed as soon as possible.

Coinkite has also received criticism for emailing some affected customers, despite claiming they delete all customer data from their storefront after 90 days in marketing material. They have since clarified that Canadian law requires they keep business records for 8 years.