🔐 VULNERABILITY: ⚠️ Coldcard Flaw Enables Theft of 594 BTC from Hardware Wallets A security vulnerability in certain Coldcard hardware wallets allowed an attacker to drain 594 bitcoin native, valued at approximately $38 million, from around 500 wallets within just 25 minutes. The issue traces back to firmware version 4.0.0, released in March 2021. According to security findings, some affected devices—particularly Mk3 models running later versions of this firmware—failed to properly use hardware-based randomness when generating recovery seeds. Instead, they resorted to a software-based key generation process using non-secret chip data, significantly reducing seed entropy and enabling an attacker to remotely reconstruct private keys without physical access to the device. The attacker targeted single-signature wallets, including some addresses that had been inactive for years, and completed the drain within minutes before consolidating most of the stolen bitcoin into a single address. Coinkite, the company behind Coldcard, issued a security alert and recommended that users who generated their seeds on affected devices migrate their funds to new wallets created with updated firmware. The company also noted that using additional entropy sources or strong passphrases during initial setup could reduce exposure. The incident underscores a key principle of hardware wallet security: if seed generation fails, even the most advanced protections lose much of their effectiveness.