Galaxy Research has identified 15 separate attackers draining BTC from vulnerable Coldcard hardware wallets. Estimated losses have exceeded $130 million from 7,300 compromised wallets, with potentially thousands of victims. The flaw stemmed from firmware that generated seed phrases with only 40 bits of entropy on Mk2 and Mk3 models instead of the intended 128 bits, allowing hackers to brute-force private keys. Coinkite has released patches for all affected models, but these updates do not repair already-generated seeds, and victims must move their BTC immediately. Approximately 90 percent of stolen BTC remains unmoved, and investigations are underway in multiple countries.
Source: Read the original article
