Coldcard attacks likely continued in waves despite efforts to mitigate
Coldcard attacks likely continued in waves despite efforts to mitigate risks Canva Collage

Bitcoin investors were taken aback after Coldcard wallets created by Canada-based Coinkite, designed to function as a BTC-only hardware cold wallet to help store BTC private keys offline, were breached.

Multiple media outlets and security experts mapped the attack and linked it to a firmware flaw in Coldcard, which was exploited to drain 1,196 BTC addresses in 41 minutes on 30th July, stealing over 1,082.65 BTCs worth over $70 million. Some experts believe the attack is ongoing in waves, while urging investors to move their funds away from affected Coldcard devices.

A Bitcoin investor, aged 39, dreamt about retiring by 50. He has been diligently investing in Bitcoin over the past eight years and was able to accumulate 2 BTCs worth $126,720 based on current trading prices. However, he lost all BTC holdings in the latest Coldcard hack, which he believes has entirely changed his mindset about the most popular cryptocurrency.

The Redditor by the username DuckDuckMoss claims to have started investing in Bitcoin because his country was subjected to multiple FATF sanctions, and didn't allow global investments like in the S&P 500 index. 'I was glad to find a kind of money that cannot be censored or debased because I just want to protect myself from the money printing and my country's weak and inflated currency compared to the dollar,' according to the viral Reddit post.

8 years of stacking, gone. I think it's time to move on.
by u/DuckDuckMoss in Bitcoin

However, after losing all BTC investments, the Redditor believes he is back to square one. He was surprised when Coldcard, which is open-source for anyone to verify and viewed as a secure way to store digital assets, was hacked.

'I'm done with Bitcoin. I'm not even sure if I still believe in it. I don't know what the future holds for it anymore. I could have stayed with traditional investments and lived a normal life. Maybe I should have just moved everything into a Bitcoin ETF when they launched. But I don't know. It's too late to do it,' the Redditor expressed.

However, the affected person disclosed that he has a physically demanding job and will return to traditional retirement investing or buy another house in the next cycle for rental income. While he lost his Bitcoin holdings, the person still has his emergency savings, a small house, and no debt.

A March 2021 firmware integration error reportedly routed seed generation to a deterministic software pseudorandom number generator instead of the STM32 hardware random number generator.

An attacker who is able to adequately constrain the device UID, timer state, and prior RNG-call history can replicate candidate output streams offline without device access, which can then be verified by deriving their addresses and comparing them with public blockchain data.

Although Coinkite swiftly rolled out an emergency firmware for affected devices on 31st July, installing it does not repair an existing seed. Coinkite told customers with exposed seeds to generate a new one on patched firmware and transfer their coins.

More Attack Sweeps Drain BTC Holdings

Galaxy Research, which mapped the 1,196-address sweep, said it found no other Bitcoin transactions in the previous 30 days with the same 30 sat/vB, no-change signature, adding that the pattern identifies the operator, not the theft, because a sweep 'looks the same as if a coin owner chose to move coins.'

Galaxy also tracked two more suspected waves of Coldcard-related sweeps, raising its observed estimate to 1,367.05 BTC, worth about $88.6 million, across 4,585 addresses.

The firm said the first two waves could share an operator based on their transaction patterns, but warned that the third wave should not be assumed to involve the same attacker.

The research firm also warned that its findings are based on on-chain analysis and that it has not computationally confirmed whether every identified address was generated with weak Coldcard entropy. The company concluded that it has reported around 600 suspected attacker-controlled addresses to federal investigators, compliance firms, and cybersecurity investigators.

Writer's pick