Coldcard Hack Exposes Risk of 'Offline' Bitcoin Storage
Hackers have exploited a software flaw in Coldcard devices, a brand of 'cold' bitcoin wallet considered one of the safest places to store cryptocurrency. The attack has resulted in the draining of tens of millions of dollars from over 4,500 wallets.
The security flaw, discovered by Block Inc's engineering team, allowed attackers to systematically recalculate and drain user wallets. This was made possible because Coinkite implemented a random-number generator that used deterministic values such as device serial numbers, rather than true randomness.
According to Galaxy Research, roughly 1,367 bitcoin worth around $86 million had been drained by Monday. Jonathan Goodman, one of the victims, described the moment he realized his wallets were compromised: 'The moment it loaded I knew I was screwed because I saw red lines for withdrawals.'