A recent data breach has targeted Coldcard, a popular bitcoin-only hardware wallet, resulting in hackers stealing over $100 million US worth of bitcoin, as per blockchain intelligence firm Galaxy Research. Coldcard, developed by Coinkite in Toronto, functions by storing “seed phrases” offline, enhancing security for users by keeping their private keys safe. These seed phrases are essential for authorizing and signing transactions on the blockchain.
The breach was caused by a software bug that allowed hackers to reconstruct wallet seed phrases, enabling them to access users’ bitcoin wallets without physical access to the device. The attack has resulted in the theft of 1,596 bitcoin from approximately 7,300 addresses, with a potential total loss of 2,055 bitcoin, valued at around $130 million US if a suspected fourth wave is confirmed.
Coinkite has issued firmware updates to address the vulnerability and has advised affected users to move their funds to secure them. The company acknowledged that the flaw originated in March 2021 due to a software error that compromised the generation of wallet seeds. Coinkite’s CEO, Rodolfo Novak, emphasized the importance of updating firmware and cautioned developers about the risks associated with AI-assisted code review.
All Coldcard users are potentially at risk due to the software bug, with 90% of the stolen bitcoin remaining stationary in the same wallets since the theft. Galaxy Research has shared details from the investigation with relevant authorities and emphasized the need to track down attacker addresses.
To safeguard their assets, users are advised to update their firmware and replace vulnerable seed phrases. Coinkite is conducting an investigation, and users have the option to transfer funds to other secure platforms. It is crucial for affected individuals not to dispose of their devices, as they may be needed for potential recovery efforts. The incident underscores the importance of constantly monitoring and securing cryptocurrency assets to prevent unauthorized access.