Kraken Chief Security Officer: Coldcard Vulnerability Leads to Over $90 Million in Bitcoin Stolen, Hardware Wallet Industry Testing Mechanisms Require Urgent Overhaul

TechFlow news, August 03, according to Cointelegraph, Coldcard hardware wallet manufacturer Coinkite disclosed that its devices have had a random number generator (RNG) vulnerability persisting for up to five years since March 2021. The vulnerability stems from mistakenly routing wallet seed generation to the less secure MicroPython pseudo-random number generator (PRNG) during a firmware upgrade, instead of the originally designed true random number generator (TRNG). Since code review only verified the existence of TRNG code but did not verify whether it was actually called, the vulnerability remained undiscovered for a long time.

Currently, over 4,500 addresses have been attacked, and nearly $90 million worth of Bitcoin has been stolen. Kraken Chief Security Officer Nick Percoco stated that this incident should serve as a "wake-up call" for the hardware wallet industry, calling for the introduction of independent third-party testing mechanisms to mandate verification of whether the entropy sources actually called by production firmware are certified. Coinkite has suspended all device shipments after confirming the vulnerability and destroyed affected inventory, while stating it will cooperate with law enforcement agencies in multiple countries to track down responsible parties.