Coldcard, a bitcoin-exclusive hardware wallet, has suffered a recent data breach resulting in hackers draining over $100 million worth of bitcoin from the wallets, as reported by Galaxy Research. The security breach has impacted many users, prompting concerns about the safety of their cryptocurrency assets.
Coldcard, developed by the Toronto-based company Coinkite, functions as a hardware wallet that does not store bitcoin itself. Instead, it enhances security by storing “seed phrases” offline within the physical device, isolated from the internet. These seed phrases serve as unique keys enabling users to authorize and sign transactions, safeguarding their bitcoin ownership.
The software bug discovered by Coinkite on Thursday allowed hackers to exploit vulnerabilities and reconstruct wallet seed phrases, leading to multiple waves of attacks. Galaxy Research disclosed that approximately 1,596 bitcoin have been stolen from around 7,300 addresses in confirmed attacks, with a potential total loss of 2,055 bitcoin, equivalent to $130 million US, if further attacks are confirmed.
Coinkite’s co-founder and CEO, Rodolfo Novak, advised affected users to transfer their funds immediately and released firmware updates to address the security flaw. The company acknowledged the flaw’s origin in March 2021 and emphasized the importance of updating affected devices to protect users’ assets.
All Coldcard users are potentially at risk due to the software vulnerability. While most of the stolen bitcoin remains untouched in the original wallets, the ongoing investigation has shared details with law enforcement agencies and other relevant entities for tracking and recovery efforts.
To safeguard their assets, users are advised to install the latest Coldcard firmware, refrain from generating new seeds on vulnerable devices, and consider transferring funds to secure addresses. Despite ongoing investigations and security measures, the impact of the breach has raised concerns among experts and users about the safety of crypto assets stored in hardware wallets.
As the situation unfolds, affected users are encouraged to stay informed and take necessary precautions to protect their investments and mitigate potential risks associated with the security breach.
