Coldcard, a bitcoin-only hardware wallet, has fallen victim to a recent data breach, resulting in hackers draining over $100 million US worth of bitcoin from the wallets. The breach was exposed by blockchain intelligence firm Galaxy Research. Coldcard, created by Coinkite based in Toronto, operates as a hardware wallet that does not store bitcoin but enhances security by storing “seed phrases” offline within the physical device, providing a layer of protection for users’ bitcoin transactions.
The vulnerability in Coldcard’s software allowed hackers to reconstruct wallet seed phrases, leading to multiple attacks and the theft of approximately 1,596 bitcoin from thousands of addresses. This figure could increase to 2,055 bitcoin, equivalent to around $130 million US if a suspected fourth wave is confirmed. The perpetrators behind the attacks remain unidentified.
To safeguard against potential compromises, Coinkite urged users to transfer their funds immediately and provided firmware updates for affected products. The company admitted that the software flaw originated in March 2021 due to using a deterministic pseudo-random generator instead of the intended hardware-backed true random number generator. The investigation revealed that most of the stolen bitcoin has not been moved or exchanged, remaining within the targeted wallets.
Users are advised not to retain compromised wallets and to install the latest firmware for protection. Coinkite emphasized that existing seed phrases generated on vulnerable devices should be replaced, as the new firmware safeguards only wallets created post-update. Galaxy Research recommended users migrate their funds to secure addresses or exchanges if unsure about the safety of their Coldcard wallets. The company also cautioned against discarding affected devices, as they may be crucial in potential fund recovery efforts.
