Kraken's security chief warns that a five-year flaw in Coldcard hardware wallets has exposed a significant testing gap. The incident highlights the need for independent verification of random number g
In an alarming revelation, it was disclosed that a critical vulnerability in Coldcard’s hardware wallet system had gone undetected for five years due to insufficient testing procedures. This flaw has now led to over 4,500 addresses being compromised and nearly $90 million worth of Bitcoin drained.
The issue stemmed from an unintended migration during the integration of a new cryptographic library in March 2021. Coldcard mistakenly routed wallet creation through a weaker MicroPython generator instead of its intended true random number generator (TRNG).
Kraken’s chief security officer, Nick Percoco, emphasized that this incident underscores the broader testing gap within hardware wallets. He called for independent verification processes to ensure the actual randomness source used in production firmware matches what was approved.
Percoco pointed out that while code reviews confirm the existence and functioning of TRNGs, there is no mechanism to verify if these are actually being utilized by the final product's firmware. This oversight contrasts with other industries like payments and cryptography where such validations are standard practice.
The implications for traders and cryptocurrency users are significant. Coldcard has halted all device shipments since confirming the vulnerability on Thursday and destroyed any remaining units containing affected firmware. However, Coinkite advised users not to dispose of their devices as they could be crucial in recovering lost funds.
This incident serves as a “wake-up call” for hardware wallet manufacturers, highlighting the necessity of robust testing protocols that independently validate randomness sources used by production systems. The broader crypto community is now closely watching these developments and calling for stricter standards across the industry.
Traders should remain vigilant, considering the potential risks associated with hardware wallets and ensuring they use products from companies that adhere to rigorous security practices.
Source: Cointelegraph. Summarized and rewritten by the Vexoda Newsroom. This is market news, not financial advice.