started · updated
Coldcard hardware wallet exploit results in $130 million Bitcoin theft
A significant firmware exploit targeting Coldcard hardware wallets has resulted in the theft of approximately 2,100 BTC, valued at an estimated $130 million. The breach, which unfolded in multiple attack waves starting around July 30, was caused by a software bug introduced in March 2021. This bug caused the device to use a weak software random number generator instead of its dedicated hardware entropy source, reducing cryptographic security from 128 bits to roughly 40 bits.
On-chain data indicates a massive movement of assets following the incident. Approximately 233,000 BTC, worth roughly $15 billion, was moved out of long-term holder wallets. Casa CEO Nick Neuman noted that while some of this movement involved Coldcard users migrating to multisig wallets, a significant portion came from Ledger and Trezor users who moved funds to safety after observing the hack.
Coinkite, the manufacturer of Coldcard, has urged all users who generated seed phrases using firmware versions 4.0.1 through 4.1.9 to treat their wallets as compromised and migrate their assets immediately.
Entities
Bitcoin · Casa · Coinkite · Coldcard · Galaxy Research · Nick Neuman
Claims
What the coverage asserts, and how well corroborated each claim is across sources.
- [○ 1 SOURCE] Coinkite advised users on firmware versions 4.0.1 through 4.1.9 to migrate funds immediately due to compromise risk. bitnewsbot.com
- [● 2 SOURCES] Some of the Bitcoin moved to safety came from Ledger and Trezor users rather than Coldcard owners. bitnewsbot.com
- [● 2 SOURCES] The vulnerability reduced cryptographic security from 128 bits to approximately 40 bits. bitnewsbot.com
- [● 2 SOURCES] On-chain data shows 233,000 BTC left long-term holder wallets following the breach. bitnewsbot.com
- [○ 1 SOURCE] Attackers drained approximately 1,596 BTC across more than 5,200 addresses in three confirmed waves. bitnewsbot.com
- [● 3 SOURCES] A firmware bug introduced in March 2021 caused key generation to use a weak software random number generator instead of hardware entropy. bitnewsbot.com · www.placedelabourse.fr