Digital Wallet
By Pankaj K
1 / 15
What Went Wrong Inside the Firmware. Coinkite's own postmortem made the mechanics pretty clear.
2 / 15
Coinkite's Response and the Legal Push. Coinkite moved fast once the flaw became public. Remaining units carrying the flawed firmware were…
3 / 15
Broader Questions for Self-Custody. The incident has rattled the self-custody space. Hardware wallets are supposed to be the safe…
4 / 15
Coldcard stopped shipping devices. All of them. The halt came after a critical flaw in the wallet's seed-generation process drained nearly $90 million in Bitcoin from over 4,500…
5 / 15
The flaw traces back to March 2021, when Coldcard's parent company, Coinkite, integrated a new cryptographic library.
6 / 15
Coinkite's own postmortem made the mechanics pretty clear. The TRNG code was there — it just got used for less critical operations.
7 / 15
Nick Percoco, Kraken's chief security officer, didn't hold back. He called the flaw a sign of deeper problems in how hardware wallets get tested across the industry.
8 / 15
Percoco pointed to other sectors as contrast. Payments hardware requires independent lab testing. Cryptographic modules go through entropy source validation. Hardware wallets?
9 / 15
See also: Galaxy Research Puts Coldcard Bitcoin Loss at $70.2M Across 1,196 Wallets
10 / 15
Users with affected devices got specific guidance: don't throw them away. Coinkite wants people to hold onto the hardware, partly because those devices may become relevant if…
11 / 15
Percoco also flagged two existing standards — NIST SP 800-90B and BSI AIS-31 — as benchmarks the hardware wallet industry should probably be using.
12 / 15
The incident has rattled the self-custody space. Hardware wallets are supposed to be the safe option — the alternative to leaving Bitcoin on an exchange and hoping the platform…
13 / 15
And that's the harder problem Percoco is pointing at. Without stringent verification processes, users have no way to know whether a device works as claimed.
14 / 15
More context: Coldcard Firmware Bug Drained Bitcoin Wallets Worth Nearly $70 Million
15 / 15
The push now is for the industry to adopt testing standards that go beyond confirming a feature exists and actually verify it's deployed correctly in firmware.
The Currency Analytics
Want the full story?