Coldcard Hack Exposes Vulnerability in Crypto Storage
A recent hacking incident has compromised over 4,500 Coldcard wallets, draining tens of millions of dollars in Bitcoin. According to Galaxy Research, around 1,367 tokens worth approximately $86 million have been stolen so far.
Coldcard is a brand of 'cold' wallet devices that are considered one of the safest places to store cryptocurrency. However, a security flaw in the software used by Coinkite's Coldcard devices allowed hackers to systematically recalculate and drain user wallets.
The issue stems from how Coinkite implemented the random-number generator when producing seed phrases, which are long strings of words used to access wallets. The company has since released fixed firmware for affected models.
Aneirin Flynn, CEO of Failsafe, said that 'the device is just responsible for generating your passwords, and if the underlying math is broken then your passwords can be reverse-engineered.'