Two hardware wallet makers are dealing with serious security flaws this week. Coinkite's Coldcard devices had a bug that let hackers drain a confirmed $115 million in bitcoin, and BitBox patched a vulnerability that could have allowed attackers to install malicious firmware and steal funds — though it says nothing was lost.
The Coldcard bug and its fallout
The Coldcard bug affected Mk3 devices running firmware version 4.0.1 or later, which started shipping in March 2021. The problem was in the random number generator, which produced weak seeds. That let attackers guess the private keys and drain wallets. Galaxy Research has confirmed $115 million in bitcoin was stolen as a result. Coinkite first warned users on July 31, and is urging everyone to move their funds immediately.
What BitBox found
BitBox discovered severe vulnerabilities in its hardware wallet firmware. One could allow an attacker to trick users into installing malicious firmware, potentially leading to theft of funds. Another memory-corruption issue affected the BitBox Multi edition, enabling arbitrary code execution and malicious firmware installation. The Bitcoin-only edition of the BitBox is not affected.
The fixes and next steps
BitBox has released the "Dixence security update" and says no funds were stolen. Users should update through the official BitBoxApp. Coldcard users, meanwhile, are told to move funds right away. The company hasn't said when a patch will land, but the warning stands.
