A recent breach has targeted Coldcard, a bitcoin-only hardware wallet, resulting in hackers stealing over $100 million worth of bitcoin, as reported by blockchain intelligence firm Galaxy Research. Coldcard, developed by Coinkite in Toronto, enhances security by storing “seed phrases” offline within the physical device, providing an added layer of protection for users’ bitcoin holdings on the public blockchain network.
The breach was due to a software bug that allowed hackers to reconstruct wallet seed phrases, enabling unauthorized access to users’ bitcoin wallets without physical possession of the device. The attack has led to the theft of 1,596 bitcoin from approximately 7,300 addresses, with a potential total loss of 2,055 bitcoin valued at around $130 million US if a suspected fourth wave is confirmed.
Coinkite has issued firmware updates to address the vulnerability and urged affected users to transfer their funds immediately. The flaw in the software, originating in March 2021, resulted from using a deterministic pseudo-random generator instead of a hardware-backed true random number generator to generate wallet seeds. The company has ceased shipments of devices with the vulnerable firmware and emphasized the importance of installing the latest update to safeguard wallets created post-fix.
All Coldcard users are advised to be cautious, as the stolen bitcoin has not been moved from the compromised wallets, indicating that the funds are still at risk. Users are encouraged to monitor their wallets and take necessary precautions. Galaxy Research and Coinkite are actively working on resolving the issue, emphasizing the significance of installing the firmware update and avoiding generating new seeds on vulnerable devices until the update is applied.
It is essential for affected users to consider moving their funds to secure addresses and follow the guidance provided by security experts. The investigation into the breach is ongoing, with efforts to identify the attackers and mitigate further risks. Coinkite has stressed the importance of not disposing of affected devices, as they may be crucial for potential fund recovery efforts in collaboration with law enforcement agencies.