You had one job. That, no doubt, is what Coldcard customers are thinking about the company now. If you’re not familiar, Coldcard makes devices to store crypto in an offline wallet—and is now notorious for a security lapse that let thieves plunder at least $100 million of Bitcoin from unsuspecting customers. Most times, news of a crypto hack is met with a “well, that’s what happens” shrug, but this one stands out because it affects a group of security-conscious Bitcoin owners who did everything right. Or so they thought.
Ordinarily, hardware wallets like Coldcard provide top-notch security, since they store crypto offline, and a wallet owner is the only one who knows the seed phrase that will unlock it. This should make the wallets virtually unhackable. Unfortunately, the company behind Coldcard made a colossal screw-up by failing to provide a randomized process for creating seed phrases. Instead, that process was based on a predictable pattern, allowing hackers who possessed a sample seed phrase to use trial-and-error to guess others—and clean out Coldcard owners in the process. (You can read a full technical breakdown here.)
