Coldcard, a bitcoin-exclusive hardware wallet, has fallen victim to a recent data breach resulting in hackers siphoning over $100 million US worth of bitcoin from the wallets. The breach, as reported by blockchain intelligence firm Galaxy Research, has raised concerns among users about the security of their cryptocurrency holdings.
Coldcard, developed by Coinkite based in Toronto, operates as a hardware wallet that does not store bitcoin directly. Instead, it enhances security by storing “seed phrases” offline within the physical device, adding an extra layer of protection to users’ bitcoin holdings. These seed phrases act as master keys for the bitcoin-only wallet, enabling users to authorize and sign transactions securely.
The breach was detected when Coinkite cautioned users about a software bug that allowed hackers to reconstruct wallet seed phrases, granting unauthorized access to users’ bitcoin wallets without physical access to the device. Galaxy Research confirmed three attack waves resulting in the theft of 1,596 bitcoin from approximately 7,300 addresses, with a potential total loss of 2,055 bitcoin valued at around $130 million US if a fourth wave is verified.
The identity of the perpetrators behind the attacks remains unknown. Coinkite’s co-founder and CEO, Rodolfo Novak, issued an advisory urging users who generated seed phrases using Coldcard wallets to transfer their funds promptly. The company has released firmware updates for affected products to mitigate the risk.
Despite ongoing investigations, the stolen bitcoin remains dormant in the same wallets, suggesting that hackers may be waiting to evade detection. Information from the investigation has been shared with U.S. law enforcement agencies, exchanges, and cyber-investigation groups to track down potential attackers. The incident underscores the vulnerability of crypto assets even when stored offline, emphasizing the importance of proactive security measures for cryptocurrency holders.
To safeguard their holdings, affected Coldcard users are advised to move their funds to secure addresses or alternative custodians. Coinkite recommends installing the latest firmware update to protect new wallets, while existing seed phrases generated on vulnerable devices should be replaced. The company is conducting a technical review, acknowledging the need for improved security measures to prevent similar breaches in the future.