Technology

The Coldcard Firmware Flaw: What Happened, Who's Affected, and How to Respond

A March 2021 firmware change caused Coldcard hardware wallets to generate Bitcoin seed phrases using a predictable software fallback instead of true hardware r…

Swipe to explore ›
AiTimeline Home
FIRST HARDWARE WALLET

Trezor Ships the First Bitcoin Hardware Wallet

SatoshiLabs released the original Trezor in 2014, widely credited as the first purpose-built Bitcoin hardware wallet -- a dedicated offline device for generating and sto…

AiTimeline Home
COLDCARD LAUNCHES

Coinkite Launches the Original Coldcard, a Bitcoin-Only Hardware Wallet

Coinkite launched the original Coldcard in 2017, positioning it as an ultra-security-focused, Bitcoin-only hardware wallet built around air-gapped signing via microSD ca…

AiTimeline Home
ROOT CAUSE COMMIT

A Single Commit Breaks Coldcard's Randomness

Coinkite committed code migrating seed generation to a proprietary internal library, replacing a call that correctly reached the hardware random-number generator with on…

AiTimeline Home
FLAWED FIRMWARE SHIPS

Firmware v4.0.1 Ships With the Silent RNG Regression

The flawed code shipped publicly in Coldcard firmware v4.0.1. From this date forward, any owner who generated a fresh seed on affected firmware received a seed built on…

AiTimeline Home
THEFT BEGINS

The First Theft Wave: 594 BTC Drained in 25 Minutes

The first confirmed theft transactions appeared on-chain around 01:10 UTC. CoinDesk reported an initial 25-minute sweep draining 594 BTC (about $38 million at the time)…

AiTimeline Home
FIRST ADVISORY

Coinkite's First Advisory and an Emergency Mk3 Patch

Around 22:50 UTC, roughly 21 hours after the first theft transactions, Coinkite published its first public advisory acknowledging a seed-generation issue affecting Mk3 d…

AiTimeline Home
SCOPE EXPANDED

Root Cause Identified; Scope Expanded to Every Model

Block's engineering team publicly identified the exact root-cause code path. Roughly eight hours after its first advisory, Coinkite revised the affected list to include…

AiTimeline Home
FULL PATCH MATRIX

Galaxy Research Confirms 1,367 BTC Across Three Waves

On-chain forensics firm Galaxy Research published a wave-by-wave breakdown: 1,367.05 BTC (about $88.6 million) drained from 4,585 addresses across three waves, noting ev…

AiTimeline Home
LATEST CONFIRMED TOTAL

Confirmed Losses Reach ~$116 Million Across a Fourth Wave

Fortune reported a fourth distinct theft wave pushed cumulative confirmed losses to roughly 1,816 BTC (about $116 million) from more than 5,200 addresses. Coinkite descr…

AiTimeline Home

Want the full timeline?

Read the complete story, FAQs and key facts.

AiTimeline Home