Coldcard Hackers Swipe $111M as Users Lose Median of 1 BTC Each
Coldcard Bitcoin Hack Exposes Vulnerability in Popular Hardware Wallet
A massive hack targeting users of the Coldcard hardware wallet has resulted in over $111 million in stolen funds, with a median loss of one BTC per victim. The attack exploited a firmware bug in devices starting from version 4.0.1 in March 2021, which allowed hackers to guess investor seedphrases.
The hack began last week Thursday, with initial losses estimated at $35 million. Coinkite, the company behind Coldcard, admitted that its software 'silently went unnoticed' and 'its potential impact grew with every release.' The firm urged users to update their software or move their funds off the wallet.
Galaxy Research analyzed 250 victim reports and found that the typical stolen coin had sat untouched for 3.5 years, with a striking 88% of pilfered funds at least a year old. One individual reportedly lost as much as 58.97 BTC in the attack.