A recent data breach targeted Coldcard, a bitcoin-only hardware wallet used by many cryptocurrency enthusiasts. Hackers managed to siphon off over $100 million worth of bitcoin from Coldcard wallets, as reported by Galaxy Research, a blockchain intelligence firm.
Coldcard, designed by Coinkite based in Toronto, functions as a hardware wallet without storing actual bitcoins. Instead, it enhances security by keeping “seed phrases” offline within the physical device, separate from the internet-connected public blockchain network where bitcoins are stored. These seed phrases serve as a secure way to authorize and sign transactions, acting as a master key for the wallet.
The breach, due to a software bug disclosed by Coinkite, allowed attackers to reconstruct wallet seed phrases without physical access to the device. Galaxy Research revealed that approximately 1,596 bitcoins were stolen from around 7,300 addresses in three confirmed attack waves, with a potential total loss of 2,055 bitcoins valued at about $130 million if a fourth wave is confirmed.
Coinkite CEO Rodolfo Novak urged users to move their funds immediately and provided firmware updates to address the issue. The vulnerability stemmed from the use of a deterministic pseudo-random generator instead of a hardware-backed true random number generator for generating wallet seeds.
All Coldcard users face the risk of their wallets being compromised by the software bug. Despite the theft, most of the stolen bitcoins remain untouched in their original wallets, indicating a cautious approach by the hackers in potentially moving the funds. Details of the ongoing investigation have been shared with relevant authorities and cybersecurity entities.
To safeguard against potential compromises, users are advised to update their Coldcard firmware and replace vulnerable seed phrases. Coinkite assured ongoing investigations and pledged to release a detailed technical review soon. Galaxy Research recommended users unsure of their safety to transfer their funds to a secure address under custodian protection.