A recent breach has targeted Coldcard, a bitcoin-exclusive hardware wallet, resulting in hackers siphoning over $100 million US worth of bitcoin from the wallets. Coldcard, developed by Coinkite in Toronto, enhances security by storing “seed phrases” offline within the physical device, serving as a master key for the bitcoin-only wallet.
The breach was due to a software bug disclosed by Coinkite, enabling hackers to reconstruct wallet “seed phrases” and access users’ bitcoin wallets without physical access to the device. Approximately 1,596 bitcoin from 7,300 addresses were stolen, with a potential total loss of 2,055 bitcoin valued at around $130 million US if a fourth wave is confirmed.
Coinkite has released firmware updates, urging users to move their funds and not generate new seeds until the fix is installed. Galaxy Research advised installing the latest update and not disposing of affected devices as they may be crucial for potential fund recovery efforts. The company is conducting an investigation, with a formal technical review forthcoming.
The attack underscores the vulnerability of crypto assets despite being offline. Experts recommend transferring funds from compromised wallets and utilizing secure addresses for migration. Coinkite and Galaxy Research continue to provide guidance to affected users on safeguarding their assets.