Weak wallet seeds expose $70 million in bitcoin

A flaw in seed generation allowed an attacker to steal more than 1,000 bitcoin from nearly 1,200 cold wallets without gaining physical or remote access to the hardware devices.

The attacker drained 1,082.65 bitcoin, valued at about $70 million, from 1,196 wallet addresses on July 30. The transfers occurred between 01:10 and 01:51 UTC and were recorded across six Bitcoin blocks, making the operation one of the largest thefts traced to predictable cryptocurrency wallet keys.

Blockchain analysts at Galaxy Research mapped the broader movement of funds after the initial discovery covered only part of the theft. Early estimates placed the loss at about 594 bitcoin, worth roughly $38 million, from around 500 wallets. Further analysis identified additional transactions and destination addresses linked by a common pattern.

The stolen bitcoin remained distributed among four addresses following the sweep. The transactions appeared in batches, with three blocks containing no related activity between the blocks used by the attacker. That pattern indicated the transfers were prepared and broadcast in groups rather than generated continuously.

The attack did not require malware on users’ computers, physical tampering with the wallets or interception of seed phrases. Instead, the attacker is believed to have exploited insufficient randomness in seed phrases generated by affected Coldcard firmware.

A hardware wallet normally creates a seed phrase using highly unpredictable data. The words represent the cryptographic foundation from which private keys and bitcoin addresses are derived. When enough randomness is used, reproducing a seed through trial and error is considered computationally impractical.

Affected firmware failed to obtain the intended level of randomness from the device’s hardware random-number generator. It instead relied partly on a software fallback seeded with data that provided far fewer possible combinations than expected.

That weakness transformed a search involving an astronomical number of potential seeds into a narrower computational task. An attacker could generate likely seeds offline, derive their corresponding bitcoin addresses and compare those addresses with activity visible on the public blockchain.

Once a match was found, the attacker could reconstruct the private key and transfer the funds. The process required no interaction with the wallet owner or the Coldcard device because the blockchain already provided a searchable record of funded addresses.

Coinkite, the Canada-based company behind Coldcard, said a complex series of firmware bugs prevented hardware-generated randomness from contributing as intended. Changes made for later devices added other sources of entropy, but these did not restore the targeted 128-bit security level.

The issue affected seeds generated on Coldcard Mk3 devices running firmware versions 4.0.1 through 4.1.9. Certain firmware used by the Mk4, Mk5 and Q models was also vulnerable. Separate Coinkite products, including Tapsigner, Opendime and Satscard, were not affected because they use different software.

Emergency firmware updates have been released for each affected model and software track. These include version 4.2.0 for the Mk3, version 5.6.0 for the Mk4 and Mk5, and version 1.5.0Q for the Q. Fixes were also issued for users running the company’s Edge firmware.

Installing an update alone cannot secure a seed created by vulnerable software. Users must generate a completely new seed after installing corrected firmware and transfer their bitcoin to addresses derived from it. The old seed remains predictable even when the device operating it has been patched.

Seeds strengthened during their original creation with at least 50 fair, independent and private dice rolls are not considered exposed by this flaw alone. A sufficiently strong BIP-39 passphrase may also prevent an attacker who has reconstructed the underlying seed from locating the protected wallet, although users must preserve that passphrase accurately.

The incident challenges the assumption that keeping a signing device offline is enough to protect cryptocurrency. Cold storage can prevent attackers from extracting a key through an internet connection, but it cannot compensate for a key that was predictable at the moment it was created.