Coldcard Hardware Wallet Firmware Flaw Enables $70 M Bitcoin Theft in 41 Minutes
What Happened — On July 30, an attacker swept 1,196 Bitcoin addresses in just 41 minutes, draining 1,082.65 BTC (≈ $70.2 M). Galaxy Research traced the sweep to a firmware integration error in Coldcard, a Bitcoin‑only hardware wallet from Coinkite, where seed generation was mistakenly routed to a deterministic software PRNG.
Why It Matters for Compliance & Audit Readiness
- The incident illustrates how a single firmware defect can bypass cryptographic controls that SOC 2’s CC6.1 – System Operations expects to be continuously monitored and validated.
- Demonstrates the need for continuous evidence collection on firmware integrity and supply‑chain attestations to prove that cryptographic assets remain protected throughout the audit period.
- Aligns directly with Verisq’s Control Mapping capability, which automates the collection of firmware‑version logs, hash verification, and change‑control records as audit‑ready evidence.
Who Is Affected – Crypto‑hardware manufacturers, custodial services, fintech platforms handling digital assets, and any organization that relies on hardware wallets for key management.
Recommended Actions
- Map the firmware‑integrity control to SOC 2 CC6.1 and begin logging firmware version hashes, release notes, and verification signatures.
- Deploy continuous monitoring to detect any deviation from approved firmware baselines and retain immutable evidence for audit review.
- Conduct a rapid third‑party firmware security assessment and update the PRNG implementation to a cryptographically secure source.
Source: The Hacker News
Technical Notes – The flaw stems from a March 2021 integration error that routed seed generation to a deterministic software PRNG rather than the intended hardware‑based entropy source, effectively exposing the seed to prediction. No CVE identifier has been published yet.