How a hidden flaw in Coldcard wallets led to an $88.6m Bitcoin theft

Coldcard is a hardware wallet aimed at serious Bitcoin users. It only supports Bitcoin, can be kept offline and uses open-source software. It is assembled in Canada and is designed to keep users' Bitcoin secure.

But from March 2021, some Coldcard devices generated customers' private keys using the device's serial number and its internal clock, rather than the dedicated chip designed to produce random numbers. That made the keys far easier to predict.

On July 30, an attacker stole 594 Bitcoin from about 500 inactive wallets in just 25 minutes. Galaxy Research has since linked the wider theft to 1,082 Bitcoin across 1,196 addresses. By August 2, the total had reached nearly 1,367 Bitcoin, worth about $88.6 million.

The attacker did not need physical access to the wallets. Coldcard's software code is publicly available, as is information on the Bitcoin blockchain.

The attacker appears to have spent several weeks working out the possible keys that the faulty software could have created. Those keys could then be matched with Bitcoin addresses holding funds. Once the vulnerable wallets had been identified, the attacker was able to move the Bitcoin. The theft itself took just 25 minutes.

Inside the flaw