Coinkite patches Coldcard firmware flaw after $130 million in bitcoin theft

Techub News said Coinkite, the maker of the Coldcard hardware wallet, has released a firmware update and told users of the Coldcard Mk4, Mk5 and Q to upgrade immediately to version 5.6.1 or 1.5.1Q. The seed-generation flaw has already been exploited. According to the report, attackers have stolen about $130 million worth of bitcoin, or more than 1,778 BTC, affecting 4,585 addresses. The attacks began in July. The report said the flaw came from a firmware defect that existed in 2021 and cut seed-generation randomness from 128 bits to about 40 bits. The first attack took 594 BTC, worth about $38 million, from roughly 500 wallets in 25 minutes. Coinkite said the attacker may have used AI to analyze the open-source firmware and identify the bug. Users now have to increase randomness manually, including by pressing buttons and rolling dice, when generating a new seed.