Coldcard Firmware Flaw Exposed: $70M Bitcoin Sweep in 41 Minutes
Coinkite disclosed that Coldcard firmware versions 4.0.1‑4.1.9 generate seeds with only ~72 bits of entropy, letting attackers enumerate private keys. The flaw enabled a July 30 sweep of 1,196 wallets, stealing 1,082.65 BTC (≈$70 M) in 41 minutes. Updated firmware for all models is now available and users must migrate seeds.