Sui co-founder builds $10 quantum-safe wallet cards after $130M Coldcard hack

Kostas Chalkias, co-founder and chief cryptographer at Mysten Labs, said he leased a factory to build quantum-safe Sui wallet cards targeting under $10 per key.

"What happened to Coldcard will NEVER happen to my people," Chalkias said, referencing the Coinkite firmware flaw that drained roughly $130 million in bitcoin from more than 7,700 addresses.

The Coldcard vulnerability, disclosed in late July, bypassed the device's hardware randomness chip during key generation, substituting a predictable software-based process tied in some cases to device serial numbers. Losses climbed in waves: roughly 594 BTC in the first wave, about 1,082 BTC by Aug. 1, and an estimated 2,055 BTC as the exploit spread. Galaxy Research's head of research, Alex Thorn, said at least 15 different attackers were working through remaining vulnerable wallets.

Chalkias set a target of 1-2 seconds per NFC quantum signature and said he may sponsor cards for users who can't afford them. The project builds on Sui's broader quantum roadmap: the network plans to add two NIST-approved signature schemes for quantum resistance, and existing Sui accounts can rotate into quantum-safe keys derived from their existing recovery phrase. Google has accelerated its post-quantum migration timeline to 2029, and blockchain startup Quantus founder Christopher Smith puts the probability of quantum computers breaking modern cryptography at "50-50" around 2028.

A $130 Million Lesson in Hardware Randomness

The Coldcard incident wasn't a quantum attack, but it illustrated the same underlying risk Chalkias is trying to get ahead of: hardware wallets that quietly fail at the cryptographic level become attack vectors until funds start moving. Coinkite disclosed that the flaw dated back to a 2021 firmware update, meaning vulnerable seeds were generated for years before the exploit surfaced.

The breach reignited the debate over who should hold private keys. U.S. spot bitcoin ETFs saw a net inflow of $626 million in the days following the incident, according to Bitcoin Magazine data, as some investors shifted toward custodial products. Casa co-founder Jameson Lopp countered that custodial institutions also rely on random number generators, while Onramp co-founder Michael Tanguma argued for multi-institutional custody with keys held by multiple regulated entities.

Sui's Quantum Roadmap

Sui's approach differs from chains that would require a hard fork to adopt post-quantum cryptography. Chalkias has argued that Sui's ability to swap in new authentication methods, including post-quantum cryptography, is a structural advantage. The network plans to add two signature schemes approved by NIST — one for everyday accounts and a second for high-value Move-based vaults.

The quantum threat extends beyond wallets. Quantus founder Christopher Smith said the first quantum attacks may target Tether's minting keys, which could allow attackers to mint tokens out of thin air through managed wallets. He noted that sufficiently powerful quantum computers could derive private keys from exposed public keys on-chain, allowing attackers to transfer funds without breaching wallets, devices, or exchange internal systems.

This article is for informational purposes only and does not constitute investment advice.