Somewhere in a 2021 code review, someone checked whether a setting existed instead of whether it was actually turned on. Five years later, that single logical slip just cost Bitcoin holders roughly $88.6 million — proof that in security, the bugs that bite hardest are rarely the flashy ones.
Forty-One Minutes, 1,196 Addresses, $70 Million Gone
Coldcard, the Bitcoin-only hardware wallet made by Coinkite, shipped a firmware integration error back in March 2021 that caused affected devices to generate wallet seeds using a deterministic software pseudorandom number generator instead of the intended hardware-based one. Because the output was deterministic and could be reproduced offline, an attacker who worked out the pattern could check candidate seeds against public blockchain data and simply walk in.
The first wave hit on July 30, draining 1,082.65 BTC — about $70.2 million — from 1,196 addresses in just 41 minutes. Two more waves followed on July 31 and August 1, pushing the total to 1,367.05 BTC, or roughly $88.6 million, drained from 4,585 addresses.
The Fix Can't Un-Ring the Bell
Coinkite pushed emergency firmware within a day of the first wave, but here's the uncomfortable part: patched firmware only stops new seeds from being generated insecurely. It does nothing to protect wallets whose seeds were already created under the flawed code, going all the way back to 2021. Anyone who generated a Coldcard seed in that window and never rotated it has effectively been sitting on a ticking clock without knowing it.
This is the quiet horror of hardware wallet security: the entire pitch is "your keys never touch a compromised system," but if the key generation itself is broken, air-gapping and PINs don't matter — the vault door was never really shut. Coinkite's own advice underscores it: don't just update, generate an entirely new seed on the patched firmware and move your coins, because restoring an old seed onto new firmware doesn't erase the underlying weakness.
A four-year-old RNG bug just proved that in crypto security, "cold storage" is only as cold as the random number generator that made it.
If keeping up with all this makes your head spin, that's what we're here for — get in touch.
Source: TechSpot