Since Thursday, hackers have stolen nearly $116 million worth of Bitcoin from Coldcard hardware wallets, affecting over 5,200 individual addresses, according to blockchain intelligence firm Galaxy Research. The stolen amount totals approximately 1,816 Bitcoin moved off the wallets, marking one of the largest crypto thefts this year, per fortune.com.
The vulnerability exploited stems from a 2021 software update by Coldcard’s maker, Canadian firm Coinkite, which altered how recovery phrases were generated. Instead of using strong, unpredictable randomness, the update introduced a flaw that weakened the security of these recovery phrases, enabling hackers to access the wallets. The attack unfolded in four waves, but investigators have not yet identified the perpetrators or linked them to known state-backed groups, according to fortune.com.
Coldcard wallets are designed as "cold" storage devices that keep Bitcoin keys offline, traditionally considered one of the safest methods for long-term holders. This breach challenges that assumption and highlights risks in hardware wallet security. Previous large crypto thefts have often been linked to North Korean or Russian state-backed groups, but this incident remains unattributed, underscoring ongoing challenges in securing digital assets, per fortune.com.
The Bitcoin engineering and security teams at fintech firm Block detailed the flaw in a report, emphasizing the critical impact of the 2021 update on Coldcard’s security. The incident has prompted renewed scrutiny of hardware wallet safety standards and recovery phrase generation methods, with over 5,200 addresses compromised as of this week, according to fortune.com.