Kraken's chief security officer Nick Percoco stated that a five-year flaw in Coldcard hardware wallets reveals a gap in independent testing, urging manufacturers to verify that approved random number generators are actually used in production firmware.
This incident highlights critical security vulnerabilities in hardware wallets, potentially eroding user trust in self-custody solutions and underscoring the need for more rigorous, end-to-end testing protocols in the digital asset space.
A five-year-old software flaw in Coldcard hardware wallets has exposed a significant gap in the independent testing of such devices, according to Nick Percoco, chief security officer at Kraken. The vulnerability, which has been exploited to drain nearly $90 million in Bitcoin from over 4,500 addresses, arose when Coldcard integrated a new cryptographic library in March 2021, inadvertently routing seed generation to a weaker MicroPython generator instead of its intended true random number generator (TRNG).
Percoco stated that the incident serves as a "wake-up call" for hardware wallet manufacturers, emphasizing the need for independent verification that the approved entropy source is the one actually executed by production firmware. He noted that while code reviews might confirm the presence of a TRNG, they often lack checks to ensure it's the one being called, a standard practice in other security-sensitive industries.
Coldcard confirmed the vulnerability and has halted all device shipments, destroying remaining units with the affected firmware. Coinkite, the company that disclosed the flaw, advised users with affected devices to keep them, as they might be essential if funds are recovered. Law enforcement coordination is underway to identify those responsible for the exploit.