Hackers steal $110 million from Coldcard hardware wallets

Hackers have stolen more than $110 million in bitcoin from Coldcard hardware wallets, according to Bloomberg.

Late last week, Canadian company Coinkite Inc. warned users about a vulnerability affecting its Coldcard devices. The flaw put the cryptographic keys protecting users’ funds at risk.

By Monday, attackers had drained around 5,000 wallets, according to analysts at Galaxy Research, stealing more than 1,755 BTC.

The breach was traced to a flaw in the random number generator used to create seed phrases. The weakness allowed attackers to systematically reconstruct users’ private keys.

Aneirin Flynn, CEO of Failsafe, said the incident highlights a fundamental limit of self-custody security.

If the underlying math is broken then your passwords can be reverse-engineered.