A recent breach has targeted Coldcard, a bitcoin-exclusive hardware wallet, resulting in hackers siphoning over $100 million in bitcoin from Coldcard hard wallets, as reported by Galaxy Research. Coldcard, developed by Coinkite in Toronto, operates as a hardware wallet that does not store bitcoin directly. Instead, it secures “seed phrases” offline within the physical device for added security. These seed phrases act as a master key for the bitcoin-only wallet, allowing users to authorize transactions securely.
The breach was disclosed by Coinkite after identifying a software bug that enabled hackers to reconstruct wallet seed phrases, leading to multiple attack waves. Galaxy Research confirmed that approximately 1,596 bitcoins were stolen from around 7,300 addresses, with the potential for further losses reaching 2,055 bitcoins, valued at about $130 million US. The attackers’ identities remain unknown.
Coinkite CEO, Rodolfo Novak, has urged users to transfer their funds promptly and install the latest firmware updates. The company acknowledged the flaw in the firmware and emphasized the importance of replacing vulnerable seed phrases. Despite ongoing investigations, experts warn of the irreversible consequences of the breach.
To mitigate risks, affected users are advised to move their funds to secure addresses or custodians. Coinkite is coordinating with law enforcement agencies to identify the responsible parties. The incident underscores the vulnerability of cryptocurrency assets and the need for enhanced security measures in the digital landscape.