Coldcard Key Generation Flaw Linked to $38M Bitcoin Theft, Onchain Lens Says 

A security flaw affecting certain Coldcard hardware wallets was exploited to steal 594 Bitcoin, valued at about $38 million, from roughly 500 single-signature wallets, according to blockchain analytics platform Onchain Lens.

The platform said the attacker drained the funds in a coordinated operation lasting about 25 minutes after exploiting a weakness in key generation on affected devices. The issue impacted wallet seeds created on Coldcard Mk3 devices running firmware version 4.0.1 or later.

Coldcard maker Coinkite said its preliminary analysis indicates the vulnerability does not affect the Mk4, Q, or Mk5 hardware wallet models.

According to Onchain Lens, the attacker consolidated 562 BTC from the theft into a single wallet address, and the funds had not moved at the time of the report.

Source: Onchain Lens