Coldcard, a hardware wallet designed for bitcoin users, has recently fallen victim to a data breach resulting in over $100 million US worth of bitcoin being stolen from its hard wallets, as reported by Galaxy Research. Coldcard, created by Coinkite, stores “seed phrases” offline to enhance security without needing an internet connection. These seed phrases are essential as they act as the master key to accessing the bitcoin-only wallet.
The breach was caused by a software bug that allowed hackers to reconstruct wallet seed phrases, enabling them to access users’ bitcoin wallets without physical access to the device. The attack has resulted in the theft of 1,596 bitcoin from around 7,300 addresses, with a potential total loss of 2,055 bitcoin valued at approximately $130 million US if a fourth wave is confirmed.
Coinkite has advised users to move their funds immediately and has released firmware updates to address the vulnerability. The company acknowledged the flaw in the software that originated in March 2021 and recommended users not generate new seeds until the update is installed. The investigation is ongoing, with details shared with law enforcement agencies, exchanges, and cyber-investigation groups.
To protect their assets, affected Coldcard users are urged to transfer their funds to a secure address at a custodian or exchange. Coinkite also cautions against disposing of affected devices, as they may be needed for potential fund recovery efforts. It is essential for users to update their firmware and take necessary precautions to safeguard their cryptocurrency holdings.