DocHex

A firmware vulnerability in their Cold Card product deliberately weakened seed randomness from 128 bits to as little as 40 bits, leading to the compromise of roughly 1,816 BTC (~$116 million) across over 5,200 addresses starting July 2026. The vulnerability was allegedly introduced by their CTO, who also incorporated a dependency on an obscure GitHub project created by a pseudonymous developer, raising questions about the integrity of their development practices and supply chain security.