THE COLDCARD Bitcoin hardware wallet has identified a critical security flaw that reduced the entropy of generated seed phrases, enabling the theft of 594 BTC (approximately $37.42 million) from 500 wallets within 15 minutes. This flaw stemmed from a firmware build error that relied on predictable values instead of true randomness, shrinking the effective seed space from 128 bits to approximately 40 bits.
The attacker exploited this by reconstructing the flawed seed generator, allowing them to derive active Bitcoin addresses and access the corresponding private keys. Users are urged to update their firmware immediately to mitigate risks, as the flaw affects multiple hardware wallet models. Compensation for affected users has not yet been addressed, though legal actions may follow.