Coldcard, a bitcoin-exclusive hardware wallet, has fallen victim to a recent data breach where hackers managed to siphon off over $100 million US worth of bitcoin from Coldcard hard wallets, as per findings from blockchain intelligence company Galaxy Research. Coldcard, developed by Coinkite based in Toronto, functions as a hardware wallet that does not store bitcoin but enhances security by keeping “seed phrases” offline within the physical device, disconnected from the internet.
The breach, which has affected many users, was due to a bug in the software that allowed hackers to reconstruct wallet seed phrases without physical access to the device. Several attack waves resulted in the theft of 1,596 bitcoin from around 7,300 addresses, with a potential total loss of 2,055 bitcoin valued at approximately $130 million US if a suspected fourth wave is confirmed. The perpetrators behind the attacks remain unidentified.
Coinkite has issued firmware updates to address the vulnerability and advised users to move their funds immediately. The flaw, identified in March 2021, stemmed from a software error that compromised the generation of wallet seeds. Despite ongoing investigations and efforts to mitigate the damage, users are urged to take precautions and not generate new seeds until the necessary updates are installed.
Galaxy Research emphasized the importance of updating firmware for affected devices and recommended users to transfer funds to a secure address or a different custodian if they suspect their Coldcard may be compromised. Coinkite also advised against disposing of affected devices as they might be crucial in potential fund recovery efforts. The company pledged to collaborate with law enforcement to identify and hold accountable those responsible for the breach.