Home›Crypto›Market Structure›Coldcard hardware wallet flaw led to $100 million in s…

Coldcard hardware wallet flaw led to $100 million in stolen bitcoin

Galaxy Research estimates 1,596 bitcoin worth over $100 million was taken from about 7,300 addresses, with at least 15 attackers exploiting the vulnerability.

Reported · Written up by our desk · Market Structure

A bug in Coldcard’s code went unnoticed for years, and multiple attacks tied to the flaw emptied users’ wallets, including one reported loss that exceeded $1 million, according to CoinDesk. Toronto entrepreneur Jonathan Goodman said that on July 29 every wallet he had was emptied and that he lost 18.25 bitcoin, worth just over $1.17 million at the time of the theft.

CoinDesk said the broader incident affected thousands of Coldcard users. Galaxy Research estimated it had high confidence that 1,596 bitcoin, worth over $100 million, was stolen from about 7,300 addresses in a series of attacks.

CoinDesk reported that Galaxy Research head Alex Thorn estimated on Aug. 4 that at least 15 different attackers were exploiting the weakness, and that none required physical access to the devices. The outlet said a hardware wallet’s security model depends on secrets never leaving the chip, so with no internet connection there should be no way in beyond physical access.

CoinDesk also explained that the vulnerability was not in the wallet itself, but in how the secret password, or seed phrase, protecting users’ coins was generated. It noted that while hardware wallets are designed to be safer than internet-connected software wallets, they are not infallible.

Latest closeBitcoin $64,381.79 ▲2.5%

More like this

Sources