- Published on
Coldcard Adds New Security Measures After $130 Million Bitcoin Exploit
- Authors
- Name
- DeepHorus
Coldcard maker Coinkite has released a major security firmware update following a critical vulnerability that led to over $130 million in Bitcoin theft. The company urged users of its Mk4, Mk5, and Q models to upgrade to firmware versions 5.6.1 or 1.5.1Q. This action follows a comprehensive three-week review involving external security researchers and AI models like Kimi.
The core issue was a seed-generation flaw dating back to 2021, which compromised the randomness used to create wallet private keys. Attackers exploited this low-entropy flaw starting in July, draining funds from air-gapped wallets. The first attack alone saw 594 BTC, worth about $38 million, stolen from approximately 500 wallets in just 25 minutes.
The scale of the theft grew significantly. By mid-August, Galaxy Research reported losses exceeded $112 million across over 1,778 BTC. The attacks were described as deliberate and programmatic, with Coinkite suggesting AI may have been used to identify the flaw in the open-source firmware code.
The updated firmware introduces stringent new measures for seed creation. Users must now manually add randomness through at least 65 key presses, 50 dice rolls, or 128 coin flips. The device combines this with its own entropy to generate a secure seed.
Beyond seed generation, the review uncovered and fixed several other vulnerabilities. Improvements were made to transaction signing, USB data handling, firmware validation, and wallet backups. The new firmware checks a transaction immediately before signing, preventing potential man-in-the-middle attacks via a compromised USB connection.
Coinkite replaced its backup random number generator with SHA-256 Hash_DRBG and added hardware checks. Users who generated seeds on affected firmware between 2021 and July 2026 are advised to create a new seed and migrate their Bitcoin.
The incident has sparked broader industry reflection. Ledger's CTO called it a "serious reminder" that a hardware wallet's security fundamentally depends on proper randomness. The event highlights the dual-edged role of AI in both uncovering and potentially exploiting vulnerabilities in cryptographic systems.
The breach underscores persistent challenges in implementing secure cryptography. Coinkite expressed gratitude to the researchers who scrutinized the fixes, stating their intensive review made the release stronger. The update represents a critical step in restoring security and trust in the Coldcard ecosystem.
