Coldcard Hackers Swipe Over $111 Million in Bitcoin
A massive Bitcoin hack has left investors reeling after hackers exploited a firmware bug in Coldcard hardware wallets. The bug, which was present in devices starting from version 4.0.1 in March 2021, caused seed generation to fall back to a weak software Pseudorandom Number Generator instead of the hardware true random number generator, allowing hackers to guess investor seedphrases.
The theft has seen over $111 million stolen, with victims reporting a median loss of 1 BTC. Galaxy Research's analysis of 250 victim reports found that 88% of pilfered funds were at least a year old and had been untouched for 3.5 years on average. Coinkite, the maker of Coldcard, has urged users to update their software or move their funds off the device.
The hack began last week Thursday with hackers taking over $35 million in Bitcoin from wallets. Since then, cautious investors have been moving their coins to other storage solutions, including exchanges. The total losses are expected to exceed $130 million, according to Galaxy Research, which is continuing its research on the matter.