A breach has targeted Coldcard, a bitcoin-only hardware wallet, resulting in hackers stealing over $100 million US in bitcoin. Coinkite, the Toronto-based company behind Coldcard, warned users of a software bug allowing hackers to reconstruct wallet “seed phrases.” This vulnerability led to multiple attack waves, resulting in the theft of 1,596 bitcoin from approximately 7,300 addresses, potentially rising to 2,055 bitcoin worth around $130 million US if a fourth wave is confirmed.
The stolen bitcoin, mostly untouched, remains in the same wallets following the theft, monitored by Galaxy Research. Investigations have shared details with U.S. law enforcement agencies, exchanges, and cyber-investigation groups. Aneirin Flynn of cybersecurity firm FailSafe highlighted the implications of the breach, emphasizing the importance of not assuming crypto assets are offline.
Users are advised to move their funds if they suspect compromise and to install Coldcard’s new firmware for post-fix wallets. Existing seed phrases generated on vulnerable devices remain at risk and should be replaced. Coinkite is conducting an investigation, with experts emphasizing the urgency for users to take necessary precautions. Impacted users have the option to transfer funds to secure addresses or trusted entities.