Coldcard Wallet Bug Exposed as Hackers Drain Over $100 Million in Bitcoin
Researchers at Galaxy Research have identified a software flaw in Coldcard hardware wallets that has allowed hackers to steal over $100 million in Bitcoin. The bug, which was present in firmware versions before March 2021, left the secret recovery phrases used to secure Bitcoin vulnerable to guessing.
The researchers found that more than 7,300 crypto wallets across three confirmed waves of theft and 14 smaller incidents had been affected, with over $100 million worth of Bitcoin stolen. The total value could reach around $130 million, including suspected losses.
Coinkite, the maker of Coldcard hardware wallets, warned that updating the firmware would not repair compromised seeds, and that users should migrate their funds to a newly generated wallet. This is particularly concerning for 600 hacked wallet addresses belonging to federal investigators, industry compliance firms, and cyber investigators.