Coldcard Provides New Safety Measures After $130 Million Bitcoin Exploit

Coldcard maker Coinkite has launched a safety overhaul for its Bitcoin {hardware} wallets after a seed-generation flaw allowed attackers to steal greater than $100 million in Bitcoin.

In a weblog submit on Thursday, Coinkite urged Coldcard Mk4, Mk5, and Q customers to improve to firmware 5.6.1 or 1.5.1Q. The discharge follows a three-week assessment of Coldcard’s techniques that included exterior safety researchers and AI fashions together with Kimi.

“We’re grateful to the safety researchers who went above and past over the previous weeks, reporting points, reproducing edge circumstances, and reviewing our fixes,” the corporate wrote. “Their work put this firmware underneath intense, sustained scrutiny and made this launch stronger.”

In July, attackers started draining Bitcoin from air-gapped Coldcard wallets after exploiting a firmware flaw courting to 2021 that generated some pockets seeds with too little randomness, making their personal keys simpler to guess. The primary assault drained 594 BTC, value about $38 million, from roughly 500 wallets in 25 minutes.

Coinkite prompt that the attackers could have used AI to study older variations of its open-source firmware and uncover the flaw.

By early August, Galaxy Analysis had tracked roughly $88.6 million stolen throughout 4,585 addresses and mentioned the assaults appeared deliberate, programmatic, and probably orchestrated utilizing a big language mannequin.

The analysis firm continued monitoring losses and by August 14 mentioned attackers had stolen greater than 1,778 BTC, value roughly $112 million on the time, throughout three main assault waves and dozens of smaller incidents.

All advised, the Coldcard exploit has now resulted in roughly $130 million in stolen Bitcoin and raised questions on entropy—the randomness used to generate pockets keys. On some affected gadgets, the flaw decreased safety from 128 bits of entropy to roughly 40 bits, making pockets seeds simpler for attackers to guess with out bodily entry to the system.

Coinkite mentioned it mounted points involving transaction signing, USB information dealing with, firmware validation, Delta Mode, and pockets backups. Coldcard now additionally requires customers so as to add randomness when producing a pockets seed utilizing at the least 65 key presses, 50 cube rolls, or 128 coin flips, which the system combines with its personal randomness.

The {hardware} pockets maker additionally changed its Yasmarang backup pseudo-random quantity generator with SHA-256 Hash_DRBG and added checks meant to catch failures within the {hardware} random quantity generator. Customers who could have generated seeds on affected variations between 2021 and July 2026 should create a brand new seed utilizing up to date firmware and transfer their Bitcoin, the corporate mentioned.

Greater than seed era

Coldcard now checks {a partially} signed Bitcoin transaction, or PSBT, instantly earlier than signing it. Beforehand, a compromised pc linked over USB might theoretically change a transaction after the person reviewed it however earlier than the Coldcard signed it.

The up to date firmware stops the signing course of and shows a warning if the transaction has modified. Coinkite described the problem as theoretical and didn’t say it had been exploited.

Coinkite additionally tightened USB information entry, hardened Delta Mode, and altered how Coldcard handles pockets backups.

Whereas AI has performed a task in patching vulnerabilities, it additionally performs a task on each side of cybersecurity and cryptography.

“We’re treating this as a critical reminder of how the entire safety mannequin of a {hardware} pockets lives or dies on randomness,” Ledger CTO Charles Guillemet advised Decrypt. “Cryptography is tough and implementing it securely is tougher. This week’s Coldcard incident made that seen in the costliest approach attainable.”

Earlier this month, swap service Boltz suspended operations after saying AI-assisted attackers had been discovering bugs sooner than its builders might repair them. A volunteer Bitcoin Purple Crew additionally used AI brokers to determine 1000’s of potential vulnerabilities throughout a whole bunch of Bitcoin initiatives.

Coinkite mentioned the investigation into the thefts stays ongoing as affected prospects proceed shifting funds to new wallets.

“Regulation enforcement authorities proceed investigating the thefts and are working to determine these accountable,” Coinkite mentioned. “We stay out there to help, and authorities are holding us knowledgeable of fabric developments,” including that the corporate “stay dedicated to supporting each buyer working by their migration till it’s completed.”