Hackers have exploited a critical security vulnerability in Coldcard hardware wallets, draining approximately $116 million worth of Bitcoin from thousands of users in what experts are calling a major breach of cryptocurrency cold storage security.
Bloomberg reports that a significant security flaw in Coldcard brand hardware wallets has resulted in the theft of roughly 1,755 Bitcoin valued at approximately $116 million from more than 4,500 wallets, according to Galaxy Research. The ongoing attack represents one of the most significant breaches of so-called cold storage cryptocurrency wallets, devices specifically designed to keep digital assets offline and secure from hackers. The total amount stolen continues to grow, with earlier estimates putting the loss at $89 million.
Canada-based Coinkite, the manufacturer of Coldcard devices, notified users late last week that a security vulnerability in the cryptographic keys protecting their cryptocurrency had compromised some wallets. By Monday, the scope of the breach had become apparent as losses continued to mount from an initial estimate of around $38 million reported on Friday.
Coldcard is a brand of hardware device that allows users to secure their Bitcoin in cold wallets, which are meant to be isolated from the internet and therefore considered among the safest storage options for cryptocurrency. However, the security breach has called into question the reliability of even these offline storage methods.
According to a report from crypto giant Block’s engineering team, the vulnerability stemmed from a flaw in how the Coldcard devices generated seed phrases. These seed phrases are long strings of words used to gain access to cryptocurrency wallets and are critical to wallet security. The flaw made these supposedly random phrases predictable to attackers.
“It exposes the fallacy of your crypto being offline,” said Aneirin Flynn, chief executive officer of cybersecurity technology firm Failsafe. “The device is just responsible for generating your passwords, and if the underlying math is broken then your passwords can be reverse-engineered.”
The technical issue centered on how Coinkite implemented the random-number generator when producing the seed phrases. True randomness is essential for cryptographic security, but Coldcard wallets had a fallback mechanism that resulted in keys being generated using deterministic values such as device serial numbers. This predictability allowed attackers to systematically recalculate seed phrases and drain user wallets.
For many victims, the realization that their funds had been stolen came as a shock. Jonathan Goodman, one of the affected users, initially believed the security issue would not impact him but decided to check his wallet as a precaution. “The moment it loaded I knew I was screwed because I saw red lines for withdrawals,” he told Bloomberg. “Between 9:36 and 9:43 p.m. on July 29th, all three of my wallets were completely drained.”
Goodman reported losing $1.6 million in Bitcoin that had been stored in cold storage, with his keys kept on a Coldcard device in a safety deposit box that had never been connected to the internet.
In a statement posted on its website, Coinkite confirmed that funds controlled by seed phrases generated on affected firmware are at risk. The company announced that fixed firmware is now available for every affected model and release track, though this comes too late for the thousands of users who have already lost their cryptocurrency.
Read more at Bloomberg here.
Lucas Nolan is a reporter for Breitbart News covering issues of AI, free speech, and online censorship.