A recent breach has targeted Coldcard, a bitcoin-only hardware wallet, resulting in over $100 million worth of bitcoin being stolen. The wallet, created by Coinkite, is designed as a secure storage solution for bitcoin users, utilizing offline storage of “seed phrases” to enhance security.
Hackers exploited a software bug in Coldcard, allowing them to access users’ wallets and steal bitcoin without physical access to the device. This vulnerability led to multiple attack waves, resulting in the theft of approximately 1,596 bitcoin from 7,300 addresses. If a fourth wave is confirmed, the total loss could reach 2,055 bitcoin, valued at around $130 million.
Coinkite has issued firmware updates to address the issue and advised users to transfer their funds to secure locations. The company acknowledged the flaw in its software, which compromised wallet seed generation, and emphasized the importance of installing the latest updates. A formal technical review is underway to assess the extent of the damage.
All Coldcard users are advised to take precautions, as their wallets may be vulnerable due to the software bug. Galaxy Research recommended not generating new seeds on affected models until the update is applied. The ongoing investigation has involved sharing details with law enforcement agencies and cybersecurity groups to track the stolen funds and identify potential attackers.
To mitigate risks, users are encouraged to move their funds to safer addresses and refrain from generating new seeds until the necessary updates are installed. Coinkite emphasized the importance of not discarding affected devices, as they may be crucial for potential fund recovery efforts. The incident highlights the importance of regular security updates and vigilance in safeguarding cryptocurrency assets.