Millions of dollars in Bitcoin stolen via Coldcard breach

Alex Thorn, research manager for the company Galaxy, specializing in cryptocurrencies, alerted Monday August 3 on X about a new wave of attacks targeting Coldcard, a physical wallet dedicated to Bitcoin and offered by the Canadian company Coinkite.

A flaw in the software of these devices allowed criminals to steal 1,755 bitcoins, the equivalent of $110 million, from more than 5,000 addresses, the same Galaxy social network reported on Friday. This first wave of attacks was the most dazzling: 1,083 bitcoins were stolen from 1,196 addresses in 41 minutes, specifies the specialized company.

However, physical “cold” wallets, like Coldcard, are very secure devices, designed to store access keys to bitcoins offline. They often come in the form of small devices, resembling USB keys and similar to external hard drives. According to a security advisory published by Block, an American financial technology company, a faulty line of code, when the software generates the private key for access to funds, weakened the security of Coldcard wallets.

This series of numbers is generated randomly by the device's chip, so as to be theoretically impossible to guess, explains Numérama. The error in the Coldcard code, however, "caused certain devices to switch to a much weaker generator", assures the specialist site.

From then on, certain recovery phrases (sequences of 12 to 24 secret passwords) became predictable enough that experienced hackers could guess them, allowing them to steal bitcoins without having to recover physical wallets, Block argues. The flaw dates back to March 2021, Coinkite acknowledged in a security notice sent to its customers on Friday.

Since then, the faulty firmware has been fixed, but this only allows users to generate a new private access key, in order to move their funds securely. To avoid exposing other Bitcoin holders to the breach, Coinkite announced on

For orders already sent, the company has contacted affected customers by email to provide them with the security advisory and steps to migrate their bitcoins to a new recovery phrase. Coinkite also advises, in another message posted on X, those affected by cryptocurrency thefts to keep the affected wallets. “They could prove essential if the funds were to be recovered. Our legal team will, if necessary, coordinate its efforts with law enforcement (…) to identify those responsible,” she said.