Coldcard, a bitcoin-only hardware wallet, has fallen victim to a recent data breach resulting in hackers stealing over $100 million US worth of bitcoin from Coldcard hard wallets, as reported by blockchain intelligence firm Galaxy Research. Coldcard, developed by Coinkite based in Toronto, functions as a hardware wallet that enhances security by storing “seed phrases” offline within the physical device, adding an extra layer of protection to the public blockchain network where bitcoin is stored. These seed phrases serve as a master key to the bitcoin-only wallet, allowing users to authorize and sign transactions securely.
The breach was disclosed by Coinkite on Thursday, warning users of a software bug that enabled hackers to reconstruct wallet seed phrases, leading to multiple attack waves and resulting in the theft of 1,596 bitcoin from around 7,300 addresses, with a potential total loss of 2,055 bitcoin valued at approximately $130 million US if a suspected fourth wave is confirmed. The vulnerability in the software was identified to have originated in March 2021, where the affected firmware relied on a deterministic pseudo-random generator instead of the intended hardware-backed true random number generator for generating wallet seeds.
All Coldcard users are at risk due to this software flaw, although approximately 90% of the stolen bitcoin remains untouched in the same wallets where they were sent, suggesting that the hackers may be waiting before making further transactions. Details from the investigation have been shared with law enforcement agencies, cryptocurrency exchanges, and cyber-investigation groups to identify attacker addresses and prevent further attacks.
To safeguard their funds, affected users are advised to move their bitcoin to a secure address, install the latest firmware update for their Coldcard device, and refrain from generating new seed phrases until the update is applied. Coinkite is conducting an investigation, with a technical review expected to be released soon. In the meantime, users are urged to take precautionary measures and consider migrating their funds to a safe address or company if they suspect their Coldcard wallet may have been compromised.