Coldcard hacking incident soars to $75 million, notify your friends quickly

Hardware wallet vulnerability caused US$75 million in Bitcoin to be stolen

Hardware wallets were supposed to be the most secure place to store Bitcoin. Devices are never connected to the Internet and the private key never leaves the device. The key is that attackers must physically hold the device to steal any assets.

On August 1, Galaxy Research said it had identified a second wave of thefts related to the same attacker who stole hundreds of Coldcard wallets a few days earlier. The company currently tracks 1,158.66 bitcoins from 2673 addresses worth approximately $75.1 million. Its preliminary statistics on July 31 were 1,082.65 bitcoins in 1196 addresses, which is twice the original estimate of 594 bitcoins.

The attacker never touched any device.

What's wrong?

The vulnerability exists in Coldcard wallet firmware produced by Canadian manufacturer Coinkite. When setting up a hardware wallet, the device generates a recovery seed (the string of words that controls Bitcoin). The seed should have come from a hardware random number generator, producing a 128-bit entropy value-a number so large that it is computationally impossible to guess.

But this is not the case. According to the Block engineering team, a code change on March 1, 2021 caused firmware to silently fall back to a software-based generator rather than a hardware generator. On Mk3 devices, the effective search space collapses to approximately 40 bits. Coinkite has confirmed this figure and called it preliminary conclusions.

The difference between 128 and 40 is not a difference in degree. This is the difference between a lock that cannot be picked open and a lock that anyone can break with rented cloud computing resources. The attacker does not need to break through any defenses. They regenerate possible seeds offline, deduce addresses, and then check which addresses hold bitcoins.

How the theft occurred

Chainalysis found that the attacker first targeted the wallet with the largest balance and stole more than $30 million in the first 10 minutes. In approximately 25 minutes, approximately 594 bitcoins were transferred from approximately 500 single-signature wallets. One victim lost approximately $1.8 million.

Galaxy tracks the collection of funds to a 41-minute window between 1:10 and 1:51 UTC on July 30, scattered in nine blocks. Coinkite's first public announcement came about 30 hours later. All stolen bitcoins in both waves of theft came from wallets created after March 17, 2021, which is the strongest evidence linking the theft to the firmware version.

Part that no one can explain

These funds were never moved. All 1,158.66 bitcoins are still unspent among seven attacker-controlled addresses. Galaxy said this was unusual for a theft of this magnitude and offered two possibilities: operators were waiting for the regulatory heat to subside, or there was no feasible way to launder such a conspicuous sum of money.

Ten years ago,$75 million in Bitcoin would be processed through a currency mixer in a matter of hours. Today, with exchange compliance requirements tightened and real-time monitoring by companies such as Galaxy and Chainalysis, moving funds has become the most difficult part.

There was almost no market response

Despite frequent alarms among Bitcoin holders, price response was almost zero. On August 1, Bitcoin was trading at approximately US$62,900, while the previous trading day's closing price was close to US$63,235, and the overall week hovered around a low of US$60,000. The 52-week price range is approximately US$57,800 to US$126,186, and the asset has fallen approximately 44% in the past 12 months.

Why risk exposure is greater than loss

The confirmed attack affected Mk2 and Mk3 devices with firmware versions 4.0.1 to 4.1.9. But Coinkite's announcement broadened the scope further: Before the fix was released, the seeds generated on Mk4, Mk5 and Q devices had only about 72 bits of entropy, rather than the expected 128 bits. This is far better than the 40th place and was not used in this theft, but it is still far below the standard level.

Users who add at least 50 independent die throws during the setup process are not considered at risk because this external entropy cannot be offset by a firmware vulnerability. Users who use strong BIP-39 passwords are equally safe. All other users who generate seeds on affected firmware are at risk.

Coinkite has released fixed firmware, but comes with a warning that is more important than the patch itself: updating firmware will not fix existing seeds. Seeds created with weak entropy will always remain weak. Affected users must generate brand new wallets on the updated hardware and transfer their bitcoins.

Call your friend

This is a story where the most useful thing a reader can do is pick up the phone. Hardware wallet users, as the name suggests, are those who take self-preservation seriously, purchase dedicated devices, and stay away from screens. Many of them won't update cryptocurrency news on Saturday.

If you know anyone who holds Bitcoin on Coldcard, send them a message today. Ask them what model they are using, which firmware version the seed was created under, and whether a dice toss or password was used when setting it up. If they used Mk2 or Mk3 to generate seeds on the affected firmware and did not use either of the methods above, their bitcoins would need to be transferred to a new wallet immediately, not next week.

The attackers in this case first started with the wallet with the largest balance. What has not yet been touched are the smaller wallets whose holders are least likely to pay attention.