How a Coldcard Bug Went Unnoticed for Years, Resulting in $100M in Hacked Crypto Funds

A critical vulnerability in Coldcard’s code remained undetected for years, ultimately leading to the theft of approximately $100 million in cryptocurrency. The bug, which was deeply embedded in the hardware wallet’s firmware, allowed attackers to exploit a flaw in the device’s random number generation process. This weakness compromised the security of private keys, enabling hackers to drain funds from affected wallets. The incident highlights significant risks in hardware wallet security and underscores the importance of regular code audits and firmware updates. Coldcard users are urged to check for patches and migrate funds to secure addresses immediately. This breach serves as a stark reminder that even trusted hardware solutions can harbor hidden vulnerabilities, impacting BTC and other digital assets.