Coldcard Heist Exceeds $114 Million Amid Ongoing Attacks
Hackers continue to drain Coldcard Bitcoin wallets, resulting in an estimated total of over $114 million stolen. The theft began on Thursday when hackers took approximately $35 million from wallets.
A firmware bug in the Coldcard Mk3 devices, starting with version 4.0.1 in March 2021, allowed hackers to guess investor seedphrases due to a weak software pseudorandom number generator instead of the hardware true random number generator. Coinkite, the manufacturer of Coldcard, has acknowledged that all its models were vulnerable following more thefts.
The company has since halted shipments and destroyed remaining inventory manufactured with the vulnerable firmware. Engineers at payments company Block investigated the hack and reported that hackers used a top blockchain services provider for help in moving the funds, contacting the provider and federal authorities with their findings.