A firmware flaw has disabled secure random number generation across multiple Coldcard hardware wallet generations, fueling an ongoing theft that has already drained 594.48 bitcoins worth approximately $38.3 million. The issue stems from the firmware disabling the chip’s built-in randomness generator and instead using the device’s serial number and internal clock to build wallet keys, both of which are fully predictable by an attacker. Devices running certain firmware released since 2021 receive virtually no real randomness, and a fix attempt in 2022 also fell short. Coinkite recommends that all affected users generate a new seed on updated hardware and move funds immediately, as firmware updates cannot undo the damage caused by this weakness.
Source: Read the original article
