A recent data breach has targeted Coldcard, a hardware wallet designed exclusively for bitcoin users. Hackers managed to siphon off over $100 million USD worth of bitcoin from Coldcard wallets, as per findings by blockchain intelligence firm Galaxy Research.
Coldcard, developed by Coinkite based in Toronto, is a hardware wallet that enhances security by storing “seed phrases” offline within the physical device, instead of holding the actual bitcoins. These seed phrases serve as a master key to the bitcoin-only wallet, allowing users to authorize and sign transactions securely.
The breach, which was disclosed by Coinkite on Thursday, exposed a software bug that enabled hackers to reconstruct wallet seed phrases, granting them access to users’ bitcoin wallets without physical access to the device. The attack resulted in the theft of 1,596 bitcoins from approximately 7,300 addresses, and potentially up to 2,055 bitcoins worth around $130 million USD if a fourth wave of attacks is confirmed.
Coinkite’s co-founder and CEO, Rodolfo Novak, urged users to transfer their funds immediately and issued firmware updates to address the vulnerability. The flaw, originating in March 2021, stemmed from the use of a flawed random number generator, rather than the intended hardware-backed true random number generator.
All Coldcard users are advised to take precautionary measures, such as updating to the latest firmware, particularly for wallets created after the fix. Galaxy Research emphasized the importance of not generating new seed phrases on vulnerable devices until the update is installed. The investigation is ongoing, with experts warning that the impact of the breach may be irreparable for some users.
In response to the breach, affected users are recommended to move their funds to secure addresses or consider using a different service for safeguarding their assets. Coinkite also advised against discarding affected devices, as they may be essential for potential fund recovery efforts in collaboration with law enforcement agencies.