A recent data breach has affected Coldcard, a bitcoin-only hardware wallet, resulting in hackers stealing over $100 million worth of bitcoin. The wallet, created by Coinkite based in Toronto, is designed to enhance security by keeping “seed phrases” offline within the physical device. These seed phrases serve as the key to the bitcoin-only wallet and are used to authorize transactions.
Coinkite issued a warning about a software bug that allowed hackers to reconstruct wallet seed phrases, leading to multiple attack waves and theft of 1,596 bitcoin from around 7,300 addresses. If a fourth wave is confirmed, the total loss could reach 2,055 bitcoin, equivalent to about $130 million. The perpetrators behind the attacks remain unidentified.
To mitigate risks, Coldcard users are advised to move their funds and update their firmware. Coinkite acknowledged the flaw in the software and urged users not to generate new seeds until the update is installed. The company is conducting an investigation, and a formal technical review will be released soon. However, some experts believe the damage has already been done.
Galaxy Research recommends affected users transfer their funds to a secure address or a different custodian/exchange. Coinkite also advised against disposing of the affected device, as it may be crucial in potential fund recovery efforts. The ongoing investigation has shared details with law enforcement agencies, exchanges, and cyber-investigation groups to track down the attackers.
