Block has disclosed two critical vulnerabilities that affect multiple generations of its Coldcard hardware wallets. The company made the disclosure public, but has not yet released a software patch or provided a timeline for one.
What the vulnerabilities mean
The vulnerabilities are rated critical, the most severe level. They affect Coldcard wallets across several product generations. Hardware wallets like Coldcard are designed to keep cryptocurrency private keys offline, but critical flaws can potentially allow an attacker to compromise that security. Block has not detailed the exact nature of the vulnerabilities or how they might be exploited.
Coldcard wallets are used by people who store significant amounts of Bitcoin and other cryptocurrencies. A critical vulnerability in such a device could put those funds at risk. Users of affected Coldcard models should pay close attention to any updates from Block. Without a patch, the safest course may be to move funds to a wallet that is not affected, though Block has not specified which generations are impacted.
What Block has said
Block disclosed the vulnerabilities but has not issued a statement beyond the disclosure. The company has not said whether it is aware of any exploits in the wild. Security researchers often find flaws in hardware wallets, and responsible disclosure typically involves giving the manufacturer time to fix them before going public. In this case, Block chose to disclose the vulnerabilities without a fix ready, which is unusual for critical issues.
What comes next
Block has not announced a release date for a patch. Users should monitor the company's official channels for updates. Until a fix is available, the risk remains. The disclosure raises questions about the security of hardware wallets that are marketed as highly secure. For now, Coldcard owners are left waiting.
