Coldcard Wallet Vulnerability

• The video describes a security flaw in Coldcard, an air-gapped Bitcoin hardware wallet, that allegedly exposed users’ private keys.
• From July 30, attackers reportedly stole more than 1,600 BTC—about $100 million—from over 7,000 wallets.
• The attackers did not need malware or phishing. They exploited weaknesses in how the wallet generated seed phrases.

How the Flaw Worked

• Bitcoin wallets use a private key derived from a 12-word seed phrase. Anyone with the phrase controls the funds.
• Coldcard had created a custom random-number generator for generating seeds, but a configuration and code-checking error meant the wallet instead used MicroPython’s basic generator.
• On the hardware’s bare-metal chip, that generator relied on deterministic inputs—the device’s serial number and a timer—rather than genuine randomness.
• As a result, attackers could search possible input combinations and recover compromised wallets’ keys.

Why Recovery Was Difficult

• Bitcoin keys cannot simply be rotated. Victims had to create new wallets and move their funds with on-chain transactions.
• Because pending transactions are visible in the public mempool, attackers could watch for rescue attempts and submit competing transactions with higher fees.
• Victims therefore tried sending transactions directly to mining pools to keep them out of public view—placing trust in a centralized intermediary.
• The company’s CEO apologized, and shipments were halted while remaining inventory was withdrawn.

Sponsor Segment

• The video also promotes Lovable, an AI app-building platform.
• The presenter says they used its planning mode to build a prediction-market app with authentication, payments, and a managed Postgres database, then connected an MCP server for live odds and trading controls.