$116M in Bitcoin Drained: The Coldcard Hardware Wallet Bug That Slept Since 2021

$116M in Bitcoin Drained: The Coldcard Hardware Wallet Bug That Slept Since 2021

Hardware wallets have long been regarded as the gold standard of cryptocurrency custody. Among these, the Coldcard Wallet, developed by Coinkite, earned a reputation as a premier choice for Bitcoin purists due to its air-gapped operation, open-source code components, and robust physical security features. However, a critical vulnerability that remained undetected in the device’s firmware since 2021 has shattered the illusion of absolute security, resulting in a cumulative loss of $116 million in Bitcoin.

This incident highlights a fundamental truth in Web3 security: even the most hardened cold storage systems are ultimately governed by code, and code is susceptible to human error. Below, we analyze the technical mechanics of the vulnerability, how the exploit was executed, and the steps users must take to secure their assets.

Understanding the Vulnerability: The Change Address Loophole

To understand the mechanics of this exploit, one must understand how Bitcoin transactions handle “change.” When you spend Bitcoin, the entire balance of the input UTXO (Unspent Transaction Output) is spent. The amount you want to send goes to the recipient, and the remainder (minus network fees) is sent back to a “change address” generated by your own wallet.

For a hardware wallet to remain secure, its firmware must verify that the change address in a Partially Signed Bitcoin Transaction (PSBT) actually belongs to the user’s own seed phrase. If the firmware fails to verify this derivation path, a compromised host computer running malicious wallet software can alter the change output, redirecting the remaining funds to an attacker’s address.

The vulnerability in the Coldcard firmware allowed exactly this. Due to a flaw in how the device parsed multisig registration configurations and derivation paths—introduced in a 2021 firmware update—the device could be tricked into signing transactions where the change address was replaced by an attacker’s address without triggering a warning on the device’s physical screen.

[Visual Asset Placeholder: Flowchart of a standard PSBT signing process vs. the exploited change-address redirection flow]

The Mechanics of the Coldcard Hack

The exploit, colloquially referred to in security circles as the “Coldcard hack,” did not involve a physical compromise of the secure element or a leak of the seed phrase. Instead, it relied on a sophisticated man-in-the-middle (MitM) attack vector targeting the host computer connected to the Coldcard Wallet.

The attack vector proceeded as follows:

1. Host Infection: The user’s desktop computer was infected with malware designed to detect Bitcoin transaction construction.
2. PSBT Manipulation: When the user initiated a transaction, the malware intercepted the PSBT file before it was exported to the MicroSD card or sent via USB to the Coldcard.
3. Change Redirection: The malware altered the change output address to one controlled by the attacker, modifying the metadata to bypass the Coldcard’s derivation path check.
4. Silent Verification Failure: Due to the firmware bug sleeping since 2021, the Coldcard validated the malicious change address as “internal” (belonging to the user) and signed the transaction. The user only saw the primary recipient’s address and amount on the screen, unaware that their change balance was being diverted.

Technical Analysis & Mitigation Steps

According to blockchain security researchers [Source: On-Chain Security Analytics Group], the vulnerability primarily impacted users utilizing complex multisig setups and customized derivation paths. Single-signature users using standard derivation paths (such as Native SegWit/Taproot defaults) were less vulnerable, though still exposed under specific edge cases.

If you use a Coldcard Wallet, immediate action is required to ensure your setup is secure:

1. Update Firmware Immediately: Coinkite has released a critical firmware patch addressing this parser bug. Ensure your device is running the latest stable firmware version verified by cryptographic signatures.
2. Verify Change Addresses Independently: For high-value transactions, verify the change address derivation path using an offline tool or a secondary, independent hardware wallet.
3. Adopt Multi-Vendor Multisig: Avoid relying on a single hardware manufacturer for multisig setups. A robust multisig quorum should combine devices from different vendors (e.g., Coldcard, Ledger, and Trezor) to prevent a single firmware bug from compromising the entire vault.

Lessons for the Web3 Industry

This $116 million exploit serves as a stark reminder that “air-gapped” does not mean “invulnerable.” An air-gapped device still receives inputs (via MicroSD cards or QR codes) and produces outputs. If the parser handling those inputs contains logical bugs, the air gap can be bypassed conceptually.

For retail and institutional investors alike, maintaining security hygiene requires continuous vigilance. Regular firmware updates, participation in community security disclosures, and the diversification of custody infrastructure remain the only viable defenses against zero-day vulnerabilities in the digital asset space.

Disclaimer: Cryptocurrency custody and hardware wallet configuration carry inherent technical risks. This article is for informational purposes only and does not constitute financial or investment advice. Always verify security procedures through official manufacturer documentation before executing transactions.