Coldcard Software Flaw Linked to Millions in Crypto Hacks

Owners of a popular bitcoin storage device are being urged to protect their cryptocurrency after security researchers identified a software flaw that may have allowed attackers to steal approximately $70 million worth of bitcoin in under an hour on July 30. Researchers at Galaxy Research reported that the attacks drained more than 1,000 bitcoin from 1,196 digital wallets within 41 minutes. Subsequent analysis by Galaxy Research identified two additional suspected waves of suspicious activity, bringing the estimated total losses to nearly $89 million. The firm cautioned that its findings are based on blockchain analysis and have not confirmed every affected wallet was created using the vulnerable software.

The issue involves Coldcard, a handheld device used by many cryptocurrency investors to store bitcoin offline, rather than on a cryptocurrency exchange. This type of device, often called a hardware wallet, is designed to prevent hackers from accessing a user's bitcoin over the internet. According to a security advisory from Block's Bitcoin Engineering and Security team, a coding error in certain versions of Coldcard may have compromised one of the wallet's key security features, potentially making recovery phrases predictable enough for sophisticated attackers to determine them under specific circumstances.

Block stated that the software bug could have allowed attackers to steal bitcoin without physically accessing the wallet. The company released its findings believing the attacks were ongoing and noted that researchers were continuing to study the exact methods of exploitation. Canadian company Coinkite, the maker of Coldcard, has since released a software update to address the problem for newly created wallets.

However, Coinkite warned that simply installing the update will not protect users who have already generated a recovery phrase using the affected software. The company is advising those users to create a new recovery phrase using the updated software and transfer their bitcoin to the newly secured wallet. Coinkite CEO Rodolfo Novak issued a public apology, stating the company was taking "full accountability for the firmware bug." Novak urged customers to act immediately, emphasizing the need to move funds and spread the warning.

Coinkite is still working to determine the exact number of affected users and plans to publish a detailed explanation of the vulnerability after its investigation concludes. The company has also stated it will assist affected customers with police reports or insurance claims and is cooperating with blockchain investigators and law enforcement agencies. Other entities, such as Jan3 CEO Samson Mow, have also advised users to migrate funds immediately. While the initial warning focused on older Coldcard devices, Coinkite has since expanded the list of affected products to include additional models and software versions. The company noted that users who generated their recovery phrase using at least 50 private dice rolls are not affected by this specific flaw, but still recommends creating a new recovery phrase and moving funds as a precaution for anyone unsure of their wallet's setup.

Separately, developers of Jack Dorsey’s Bitkey wallet are investigating a different reported issue but are not advising customers to stop using the wallet, stating the reported vulnerability would require exceptional circumstances to exploit and would not provide enough information for an attacker to steal funds.