🚨 BREAKING: THE WORST HARDWARE WALLET HACK IN BITCOIN HISTORY!!!
$38M drained from 500 cold wallets in 25 minutes. The attacker never touched a single device.
If you are a Coldcard Mk3 owner, move your coins today.
Quick version of what happened:
594 BTC drained from ~500 air-gapped wallets in 25 minutes. These wallets never touched the internet. Turns out another 488 BTC was stolen earlier the same way and nobody noticed. Over 1,000 BTC gone.
And the attacker never hacked a single device.
A firmware bug from 2021 made the Mk3 skip its randomness chip when creating seeds. So your "random" 24 words were basically generated from the device clock and how fast you pressed buttons.
One developer literally predicted his own seed phrase by counting his button presses during setup.
Think about that. Life savings protected by button timing.
The attacker figured this out, precomputed the keys, then sat on them for 5 years waiting for the wallets to fill up. Then took everything in one shot.
And the uncomfortable part:
This code was open source the whole time. Public repo, "thousands of eyes," don't trust verify, all of it. The bug sat there for 5 years and nobody looked.
If your seed came out of a black box you never checked, you don't really own your Bitcoin. You're holding it until someone smarter takes it.
(If you used a passphrase or dice rolls you're fine. Mk4, Mk5, Q, Ledger, Trezor also fine. And watch out for fake "support" accounts in your DMs right now, they're circling.)
COLDCARD Mk3 Security Advisory
If you generated a seed on a Mk3 after firmware 4.0.1, your funds may be at risk.
Mk4, Q and Mk5 are not affected based on our early analysis.
Read the advisory and migrate carefully:
blog.coinkite.com/coldcard-m…