Coldcard exploit sparks call for independent audits: Kraken CSO

cryptonews15:22

Coldcard’s five-year seed-generation flaw has renewed calls for independent testing of hardware wallet firmware after suspected attacks have drained nearly $90 million worth of Bitcoin from thousands ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2656432640?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-08-03 15:22","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2656432640","market":"nz","top_or_hot":-1,"title":"Coldcard exploit sparks call for independent audits: Kraken CSO","media":"cryptonews","content":"<div>\n<p>Coldcard’s five-year seed-generation flaw has renewed calls for independent testing of hardware wallet firmware after suspected attacks have drained nearly $90 million worth of Bitcoin from thousands ...</p>\n\n<a href=\"https://crypto.news/coldcard-exploit-sparks-call-for-independent-audits-kraken-cso/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Coldcard exploit sparks call for independent audits: Kraken CSO</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nColdcard exploit sparks call for independent audits: Kraken CSO\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-08-03 15:22 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/coldcard-exploit-sparks-call-for-independent-audits-kraken-cso/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Coldcard’s five-year seed-generation flaw has renewed calls for independent testing of hardware wallet firmware after suspected attacks have drained nearly $90 million worth of Bitcoin from thousands ...</p>\n\n<a href=\"https://crypto.news/coldcard-exploit-sparks-call-for-independent-audits-kraken-cso/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"BTCL","symbol_name":"T-REX 2X LONG BITCOIN DAILY TARGET ETF","start_time":0,"source_url":"https://crypto.news/coldcard-exploit-sparks-call-for-independent-audits-kraken-cso/","article_id":"2656432640","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/coldcard-exploit-sparks-call-for-independent-audits-kraken-cso/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2656432640","pubTimestamp":1785741744,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"Coldcard’s five-year seed-generation flaw has renewed calls for independent testing of hardware wallet firmware after suspected attacks have drained nearly $90 million worth of Bitcoin from thousands of wallets.Kraken’s chief security officer has called for independent testing of hardware wallet seed generation after the Coldcard security flaw.Suspected attacks have drained nearly $90 million in Bitcoin, with Galaxy Research tracking more than 5,200 potential victim addresses.Coinkite has released fixed firmware but says affected users must create new seed phrases because updates cannot repair existing wallets.Block’s Bitcoin engineering and security team independently reached the same conclusion during its technical review. The company said the affected firmware invoked the deterministic MicroPython fallback instead of the STM32 hardware random-number generator when creating wallet seeds. Although Block said it had not completed full empirical tes","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"83042":"华夏比特币-R","BTCL":"T-REX 2X LONG BITCOIN DAILY TARGET ETF","BTFX":"比特币期货ETF-CoinShares","CBTA":"Calamos Bitcoin 80 Series Structured Alt Protection ETF – April","BTCO":"比特币ETF-Invesco Galaxy","BITB":"比特币ETF-Bitwise","BITY":"Amplify Bitcoin 2% Monthly Option Income ETF","ARKB":"比特币ETF-21Shares","09042":"华夏比特币-U","OOQB":"One+One Bitcoin and Ether ETF","03439":"嘉实比特币","DEFI":"比特币期货ETF-Hashdex","BITI":"1倍做空比特币期货ETF-Proshares","09439":"嘉实比特币-U","BFAP":"FT Vest Bitcoin Strategy Floor15 ETF - April","CBTO":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - October","BTCW":"比特币ETF-Wisdom Tree","DFII":"FT Cboe Vest Bitcoin Strategy & Target Income ETF","BTRN":"比特币期货ETF-Global X","EZBC":"比特币ETF-Franklin","FBTC":"比特币ETF-Fidelity","BITO":"比特币期货ETF-ProShares","BCCC":"Global X Bitcoin Covered Call ETF","CBTY":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - July","XBTY":"GraniteShares YieldBOOST Bitcoin ETF","MAXI":"比特币期货ETF-Simplify","BTYB":"VistaShares BitBonds 5 Yr Enhanced Weekly Distribution ETF","03008":"博时比特币","BTC":"Grayscale Bitcoin Mini Trust","CBOY":"Calamos Bitcoin Structured Alt Protection ETF - July","MNRS":"GRAYSCALE BITCOIN MINERS ETF","CBXJ":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - January","09008":"博时比特币-U","SBIT":"2倍做空比特币期货ETF-Proshares","BITU":"2倍做多比特币期货ETF-Proshares","03042":"华夏比特币","BTCC":"Grayscale Bitcoin Covered Call ETF","CBOA":"Calamos Bitcoin Structured Alt Protection ETF - April","BTCI":"NEOS Bitcoin High Income ETF","BPI":"Grayscale Bitcoin Premium Income ETF","CBXO":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - October","BITX":"2倍比特币期货ETF-Volatility Shares","GBTC":"比特币ETF-Grayscale","BRRR":"比特币ETF-CoinShares","IBIT":"比特币ETF-iShares","BFJL":"FT Vest Bitcoin Strategy Floor15 ETF - July","CBXY":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - July","HODL":"比特币ETF-VanEck"},"translate_title":"冷卡漏洞引发独立审计看涨期权：Kraken CSO","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"83042":0.6,"BTRN":0.6,"CBOA":0.6,"SBIT":0.6,"HODL":0.6,"BITI":0.6,"03042":0.65,"EZBC":0.6,"MAXI":0.6,"CBXJ":0.6,"FBTC":0.6,"BTYB":0.65,"CBXY":0.6,"BITB":0.6,"CBTO":0.6,"CBXO":0.6,"ARKB":0.6,"09042":0.65,"BTFX":0.6,"CBTY":0.6,"BTCI":0.6,"BFAP":0.6,"BTCC":0.6,"OOQB":0.83,"BITX":0.6,"09008":0.65,"BTC":0.6,"BITY":0.6,"BTCW":0.6,"09439":0.65,"CBTA":0.6,"BTCO":0.6,"GBTC":0.6,"BITO":0.6,"CBOY":0.6,"BITU":0.6,"BTCL":0.6,"03439":0.65,"BRRR":0.6,"03008":0.65,"DEFI":0.6,"IBIT":0.83,"BPI":0.6,"BCCC":0.6,"XBTY":0.6,"MNRS":0.6,"DFII":0.6,"BFJL":0.6},"content_text":"Coldcard’s five-year seed-generation flaw has renewed calls for independent testing of hardware wallet firmware after suspected attacks have drained nearly $90 million worth of Bitcoin from thousands of wallets.\n\n\nSummary\n\n\n\nKraken’s chief security officer has called for independent testing of hardware wallet seed generation after the Coldcard security flaw.\nSuspected attacks have drained nearly $90 million in Bitcoin, with Galaxy Research tracking more than 5,200 potential victim addresses.\nCoinkite has released fixed firmware but says affected users must create new seed phrases because updates cannot repair existing wallets.\nSecurity researchers traced the issue to a firmware error that used a weaker random number generator during wallet creation.\n\n\n\nKraken chief security officer Nick Percoco said in a post on X on Sunday that the incident should serve as a warning for the hardware wallet industry, arguing that manufacturers should not be the only parties verifying how wallet seed phrases are generated. \n\nhttps://t.co/cIjpnVnMDM— Nick Percoco (@c7five) August 2, 2026\n\nHe said production firmware should undergo independent testing to confirm that the approved source of randomness is the one actually used when creating wallet secrets.\nAccording to Galaxy Research’s latest blockchain analysis, suspected attackers have now swept more than 1,800 BTC from over 5,200 potential victim addresses across four observed attack waves, although the firm has stressed that those figures are on-chain estimates rather than confirmed losses. Coinkite has not verified every affected wallet, and blockchain data alone cannot determine whether a single actor carried out all of the attacks.\nColdcard flaw escaped review for more than five years\nCoinkite disclosed on Thursday that the vulnerability dates back to March 2021, when the company migrated part of its firmware while integrating a new cryptographic library.\nInstead of using Coldcard’s intended hardware-backed true random number generator to create wallet seeds, the updated firmware accidentally called a weaker deterministic pseudo-random generator provided by MicroPython. \nAccording to Coinkite’s postmortem, the intended random-number generator remained active elsewhere in the firmware, allowing code reviews to verify its presence without revealing that wallet creation relied on a different source of entropy.\nThe company said it was unaware that the MicroPython generator existed in the relevant code path until the investigation. While the hardware random-number generator continued operating for other functions, it was no longer responsible for generating new wallet secrets.\nBlock’s Bitcoin engineering and security team independently reached the same conclusion during its technical review. The company said the affected firmware invoked the deterministic MicroPython fallback instead of the STM32 hardware random-number generator when creating wallet seeds. Although Block said it had not completed full empirical testing of every device, it decided to disclose its findings because reports of active theft had already emerged.\nCoinkite estimates that seeds created on affected Mk2 and Mk3 devices may contain about 40 bits of effective entropy, while affected Mk4, Mk5 and Q models may contain about 72 bits instead of the intended 128 bits.\nHardware wallet testing has lacked entropy verification\nUsing the Coldcard incident as an example, Percoco argued that hardware wallet certification has overlooked one of the most important parts of wallet security.\nHe said users currently have to trust that manufacturers correctly implement seed generation because no independent process verifies that production firmware actually calls the approved entropy source. Existing certifications, including Common Criteria evaluations for secure elements, CSPN reviews and vendor-sponsored audits, do not systematically validate that relationship, according to Percoco.\nTo illustrate the gap, he pointed to NIST SP 800-90B, the U.S. standard governing the design and validation of true random-number generators used in cryptographic systems, along with Germany’s BSI AIS-31 framework, which sets similar testing requirements. He argued that comparable end-to-end verification does not currently exist for hardware wallets.\nPercoco also compared the sector with payment security, noting that PIN entry devices cannot be shipped without independent laboratory testing, while U.S. government cryptographic modules require entropy source validation before approval.\nColdcard users still need new wallet seeds\nAs attack activity continued over the weekend, Coinkite said it had halted all shipments after confirming the vulnerability and destroyed every remaining device in its facilities containing the affected firmware.\nThe company nevertheless advised customers not to discard affected devices because they may become important if stolen funds are eventually recovered through legal proceedings. Coinkite added that its legal team would coordinate with law enforcement agencies in multiple jurisdictions where appropriate.\nFirmware updates have already been released for every affected model, including version 4.2.0 for Mk2 and Mk3, version 5.6.0 for Mk4 and Mk5, version 1.5.0Q for Coldcard Q, and versions 6.6.0X and 6.6.0QX for Edge releases. According to the company, installing updated firmware only fixes future wallet creation and does not strengthen seed phrases generated before the patch.\nFor that reason, users covered by the advisory are being instructed to generate entirely new seed phrases after updating their devices, verify a receiving address, send a small test transaction, and migrate the remaining balance only after confirming the transfer succeeded.\nCoinkite said wallets created using at least 50 fair, private dice rolls are not considered exposed by the random-number-generation flaw alone. The company added that a strong and unique BIP-39 passphrase provides another layer of protection but does not remove the weakness from an already affected seed, meaning migration remains the recommended course of action.\nOngoing attacks continue to expand the known losses\nSeparate blockchain analysis from Galaxy Research indicates that the attacks have continued since the vulnerability became public.\nAlex Thorn, head of research at Galaxy, identified a suspected fourth coordinated attack wave on Aug. 3, bringing the firm’s observed total to about 1,815.75 BTC across 5,294 potential victim addresses if none of the address groups overlap. Thorn described the wallets as “likely Coldcard victims” and emphasized that the figures come from blockchain analysis rather than confirmed device records or law enforcement findings.\nGalaxy also reported that attack activity reached 13.8 wallet sweeps per block during the latest wave, compared with a baseline of 0.3 sweeps per block before the incident. The firm observed that most victim balances were sent to newly created addresses instead of a single collection wallet, while some funds had already moved through second-hop transactions, making the stolen Bitcoin harder to trace.\nAccording to Galaxy, users whose stolen funds remain in unconfirmed Bitcoin transactions may still have a narrow opportunity to broadcast a higher-fee replacement transaction before miners confirm the original transfer. \nCiting Bitcoin Core documentation, the research firm noted that Replace-by-Fee can only be attempted while the transaction remains unconfirmed and does not guarantee recovery even when the legitimate owner still controls the affected keys.\n\n\n\n\n\n                Read more:\n            \n\n                Bitcoin price faces 5 macro tests this week","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.47.0","shortVersion":"4.47.0","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2656432640","isCrawlerRequest":true}