A cyberattack has targeted Coldcard, a bitcoin-only hardware wallet, resulting in hackers siphoning off more than $100 million US worth of bitcoin, as per blockchain intelligence firm Galaxy Research. Coldcard, developed by Coinkite in Toronto, functions by safeguarding “seed phrases” offline within the device without requiring internet connection. These seed phrases serve as a master key for the bitcoin-only wallet, enabling users to authorize transactions securely.
Coinkite recently cautioned users about a software bug that allowed hackers to reconstruct wallet seed phrases, leading to multiple attack waves. Galaxy Research reported that around 1,596 bitcoins were stolen from approximately 7,300 addresses in confirmed attacks, with a potential total loss of 2,055 bitcoins valued at roughly $130 million US if another wave is confirmed. The perpetrators behind the attacks remain unidentified.
To mitigate the risks, Coinkite urged users who generated seeds using a Coldcard wallet to transfer their funds immediately. They released firmware updates for affected products to address the vulnerability. The company acknowledged the flaw originated in March 2021 due to a software glitch, emphasizing the importance of installing the latest updates. Coinkite also stressed the impact of AI in identifying such vulnerabilities rapidly.
All Coldcard users are at risk of potential wallet compromise due to the software bug. Despite the theft, most of the stolen bitcoins remain untouched in their original wallets, according to Galaxy Research. The firm is collaborating with law enforcement, exchanges, and cyber-investigation groups to track down the attackers. Experts caution against keeping compromised bitcoins in the affected wallets and recommend installing the new firmware to safeguard against further exploits. Users are advised to move their funds to secure addresses or fresh seeds for protection.
The incident underscores the importance of prompt action to secure digital assets and prevent further losses. REWRITE_BLOCKED: The content is excessively violent and depicts graphic scenes unsuitable for rewriting.