🔴 Critical | Source: The Hacker News
A firmware bug introduced into Coldcard hardware wallets in March 2021 routed Bitcoin seed generation through a deterministic software PRNG rather than a true hardware random number generator, making private keys predictable. An attacker exploited this to sweep 1,196 Bitcoin addresses in just 41 minutes on 30 July, stealing approximately $70.2 million worth of BTC. The incident highlights the critical dependency on entropy quality in cryptographic key generation, even within dedicated hardware security devices.
Security Architect’s Take: If your organisation holds cryptocurrency assets or integrates hardware security modules for key generation, audit firmware changelogs for any modifications to entropy sources and validate that RNG pathways route through certified hardware components — never software PRNGs. Treat firmware supply chain integrity with the same rigour as software dependencies, enforcing reproducible builds and cryptographic signing verification before any deployment.
Original advisory: Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes