Coldcard hardware wallets suffered a critical firmware vulnerability (dating to March 2021) allowing attackers to derive private keys using weak entropy—affecting approximately 4,585 wallets and ~1,367 BTC (~$89M). The flaw stems from the device using predictable data (serial number, system clock) instead of true random number generation when generating wallet seeds. Coinkite has released a firmware patch (August 1) and advises users to immediately move assets to new wallets on unaffected devices. Other major hardware wallet providers (Ledger, Trezor, Bitkey, Jade) confirmed they are unaffected as the vulnerability is specific to Coldcard's firmware implementation.