🔐 VULNERABILITY: ⚠️ Flaw in Coldcard allows theft of 594 BTC from hardware wallets A security vulnerability in certain Coldcard hardware wallets enabled an attacker to drain 594 bitcoin:native, valued at approximately $38 million, from around 500 wallets within just 25 minutes. The issue dates back to firmware 4.0.0, released in March 2021. According to security findings, some affected devices—particularly Mk3 models with later versions of that firmware—failed to properly use hardware-based randomness when generating recovery seeds. Instead, they could rely on a software-based key generation process using non-secret chip data. This significantly reduced seed entropy and could allow an attacker to remotely reconstruct private keys without physical access to the device. The attacker targeted single-signature wallets, including some addresses that had not moved funds for years, and completed the drain within minutes before consolidating most of the stolen bitcoin into a single address. Coinkite, the company behind Coldcard, issued a security alert and recommended that users who generated their seeds on affected devices migrate their funds to new wallets created with updated firmware. The company also noted that using additional dice or robust passphrases during initial setup could reduce exposure. The incident reinforces a key principle of hardware wallet security: if seed generation fails, even the most advanced protections lose much of their effectiveness.