how a build flag drained 116M in bitcoin
A single line of firmware shipped in March 2021 told every Coldcard hardware wallet to skip its dedicated randomness chip. For five years nobody noticed. Then an attacker brute-forced the weak seeds in 41 minutes, draining 1,816 BTC from more than 5,200 addresses across four attack waves. The incident is the largest hardware wallet exploit
