Coldcard Adds New Security Measures After $130 Million Bitcoin Exploit

“We are grateful to the security researchers who went above and beyond over the past weeks, reporting issues, reproducing edge cases, and reviewing our fixes,” the company wrote. “Their work put this firmware under intense, sustained scrutiny and made this release stronger.”

Coinkite said it fixed issues involving transaction signing, USB data handling, firmware validation, Delta Mode, and wallet backups. Coldcard now also requires users to add randomness when generating a wallet seed using at least 65 key presses, 50 dice rolls, or 128 coin flips, which the device combines with its own randomness.

The hardware wallet maker also replaced its Yasmarang backup pseudo-random number generator with SHA-256 Hash_DRBG and added checks intended to catch failures in the hardware random number generator. Users who may have generated seeds on affected versions between 2021 and July 2026 must create a new seed using updated firmware and move their Bitcoin, the company said.

Coldcard now checks a partially signed Bitcoin transaction, or PSBT, immediately before signing it. Previously, a compromised computer connected over USB could theoretically change a transaction after the user reviewed it but before the Coldcard signed it.

The updated firmware stops the signing process and displays a warning if the transaction has changed. Coinkite described the issue as theoretical and did not say it had been exploited.

Coinkite also tightened USB data access, hardened Delta Mode, and changed how Coldcard handles wallet backups.

While AI has played a role in patching vulnerabilities, it also plays a role on both sides of cybersecurity and cryptography.

Coinkite said the investigation into the thefts remains ongoing as affected customers continue moving funds to new wallets.

“Law enforcement authorities continue investigating the thefts and are working to identify those responsible,” Coinkite said. “We remain available to assist, and authorities are keeping us informed of material developments,” adding that the company “remain committed to supporting every customer working through their migration until it’s done.”