Coldcard, a popular bitcoin-only hardware wallet, has fallen victim to a recent data breach resulting in hackers siphoning off over $100 million US worth of bitcoin, as per findings by Galaxy Research. The breach has raised concerns about the security of the cryptocurrency assets held in such wallets.
Coldcard, developed by Coinkite based in Toronto, functions as a hardware wallet that does not store bitcoins but enhances security by storing “seed phrases” offline within the device. These seed phrases, serving as master keys, allow users to authorize transactions securely without an internet connection.
The breach stemmed from a software bug in Coldcard’s system that enabled hackers to reconstruct wallet seed phrases, granting unauthorized access to users’ bitcoin wallets. This vulnerability led to multiple attack waves, resulting in the theft of 1,596 bitcoins from around 7,300 addresses, with a potential total loss of 2,055 bitcoins valued at approximately $130 million US if a fourth wave is confirmed.
Coinkite has issued firmware updates to address the exploit, urging affected users to transfer their funds immediately. The company acknowledged the flaw’s origin in March 2021 and emphasized the importance of installing the latest firmware to safeguard against further breaches.
Despite ongoing investigations and efforts to mitigate the impact, the incident underscores the risks associated with storing cryptocurrencies in hardware wallets. Users are advised to take precautionary measures, such as migrating their funds to secure addresses or utilizing alternative storage options.
Galaxy Research and Coinkite continue to collaborate with law enforcement agencies and cybersecurity experts to identify the perpetrators and prevent future attacks. The breach serves as a cautionary tale highlighting the importance of maintaining robust security measures in the rapidly evolving landscape of digital assets.