A recent breach has impacted Coldcard, a bitcoin-only hardware wallet, resulting in hackers stealing over $100 million US in bitcoin from the wallets, as per Galaxy Research. Coldcard, developed by Coinkite in Toronto, acts as a secure storage solution by safeguarding “seed phrases” offline within the device, enhancing the protection of user transactions on the blockchain network.
Due to a software bug discovered by Coinkite, hackers exploited the vulnerability to access users’ wallets and steal bitcoin without physical access to the device. As per Galaxy Research’s on-chain analysis, approximately 1,596 bitcoin has been stolen across various addresses, with a potential increase to 2,055 bitcoin if additional attacks are confirmed, amounting to around $130 million US.
Coinkite has advised users to transfer their funds promptly and has released firmware updates to address the issue. The company acknowledged the flaw in the firmware, which deviated from the intended secure method of generating wallet seeds. Coinkite emphasized the importance of updating affected devices and not generating new seeds until the fix is applied.
The ongoing investigation into the attacks involves sharing details with law enforcement agencies, exchanges, and cyber-investigation groups. Aneirin Flynn from FailSafe highlighted that the breach exposes the misconception of offline crypto security, urging affected users to take immediate action to protect their assets.
To mitigate risks, users are encouraged to install the latest firmware updates, migrate funds to secure addresses, and refrain from generating new seeds on vulnerable devices. Despite Coinkite’s efforts, experts warn that the damage may have already occurred, emphasizing the need for swift and proactive measures to safeguard cryptocurrency assets.
