SKN | Coldcard Security Flaw Exposes Hardware Wallet Testing Gap, Says Kraken Security Chief

• Kraken Chief Security Officer Nick Percoco said the five-year Coldcard vulnerability exposes weaknesses in hardware wallet security testing.
• The flaw remained undetected because auditors verified the presence of the intended random number generator but did not confirm it was actually being used by the firmware.
• The suspected exploit has affected more than 4,500 Bitcoin addresses, with estimated losses approaching $90 million.
• Coinkite has halted shipments of affected Coldcard devices and is cooperating with law enforcement while continuing its investigation.

The security flaw affecting certain Coldcard Bitcoin hardware wallets has prompted renewed calls for stricter industry-wide security testing standards.

Nick Percoco, Chief Security Officer at cryptocurrency exchange Kraken, described the incident as a “wake-up call” for hardware wallet manufacturers, arguing that existing audits are insufficient to verify one of the most important components of wallet security: random number generation.

According to Percoco, independent testing should not only confirm that an approved random number generator exists within a device but also verify that production firmware actually uses it when creating wallet recovery seeds.

Five-Year Vulnerability Escaped Detection

The vulnerability dates back to March 2021, when Coldcard manufacturer Coinkite modified its wallet seed-generation process while integrating a new cryptographic software library.

During that migration, wallet creation was inadvertently routed to a weaker MicroPython pseudo-random number generator (PRNG) instead of Coldcard’s intended true random number generator (TRNG).

Coinkite explained in its technical review that the secure TRNG remained present in the software and continued functioning for less critical operations, making the flaw difficult to identify during conventional code reviews.

As a result, auditors could verify that the intended entropy source existed without confirming it was actually responsible for generating wallet recovery seeds.

Researchers Estimate Nearly $90 Million in Losses

The vulnerability is believed to be connected to an ongoing attack targeting wallets created with affected firmware.

According to current estimates, more than 4,500 Bitcoin addresses have been compromised, with total losses approaching $90 million worth of Bitcoin.

Security researchers continue tracing affected wallets while warning that additional compromised addresses may still emerge as the investigation progresses.

Calls for Industry Standards

Percoco argued that hardware wallet manufacturers should adopt security validation practices similar to those already required in other sectors handling sensitive cryptographic operations.

He pointed to established standards such as NIST SP 800-90B, which governs entropy validation for cryptographic random number generators in the United States, and BSI AIS-31, a comparable framework developed by Germany’s Federal Office for Information Security.

According to Percoco, hardware wallets currently lack an equivalent end-to-end verification process that independently confirms production firmware uses the validated entropy source.

He noted that payment terminals and government-approved cryptographic modules undergo far more rigorous independent testing before deployment.

Coinkite Suspends Shipments

Following confirmation of the vulnerability, Coinkite announced that it has halted all shipments of affected Coldcard devices.

The company also confirmed it has destroyed all remaining inventory containing the vulnerable firmware.

However, Coinkite advised existing users not to discard affected devices, explaining they may become important if future recovery efforts or forensic investigations require the original hardware.

The company said its legal team is coordinating with law enforcement agencies across multiple jurisdictions as investigators continue working to identify those responsible for the thefts.

Outlook

The Coldcard incident has highlighted the importance of comprehensive security validation throughout the hardware wallet industry. While current investigations focus on the specific vulnerability affecting certain Coldcard devices, the broader discussion is shifting toward stronger independent verification standards for cryptographic implementations. As Bitcoin adoption continues to grow, manufacturers and security experts are expected to place greater emphasis on rigorous testing of wallet firmware and entropy generation to strengthen confidence in self-custody solutions.