Coldcard Exploit Could Result in Loss of over 2,000 Bitcoin, Galaxy Research Estimates

Coldcard Exploit Could Result in Loss of over 2,000 Bitcoin, Galaxy Research Estimates

A recent analysis by Galaxy Research has revealed significant security vulnerabilities in the Coldcard hardware wallet, leading to estimations of losses reaching up to 2,055 Bitcoin, valued at nearly $130 million. This figure encompasses confirmed thefts as well as a potential fourth wave of attacks that remains unverified.

Confirmed Theft and Potential Losses

Galaxy Research has reported that approximately 1,596 Bitcoin has already been stolen across three confirmed attack waves, impacting about 7,300 addresses. The firm also noted that 14 additional minor security incidents are related to the Coldcard vulnerability. Investigators are sharing the identified attacker and victim addresses with U.S. law enforcement, cryptocurrency exchanges, and cyber investigation groups to aid the ongoing investigation.

Monitoring Unconfirmed Attacks

While the confirmed losses stand at 1,596 BTC, Galaxy indicates that if the suspected fourth attack wave is verified, total losses could rise to 2,055 BTC. Alex Thorn, head of firmwide research at Galaxy, noted patterns indicative of this potential fourth wave, although confirmation from victims is still pending. Initial blockchain analyses suggested a higher loss estimation of roughly 1,815.75 BTC, but the latest update focuses on narrowed confirmed losses.

Coldcard Vulnerability Explained

The vulnerability stems from a flaw in the Coldcard Mk3, Mk4, Mk5, and Q devices introduced in March 2021. This flaw resulted from a new cryptographic library being integrated into the firmware, leading to incorrect seed generation. Instead of utilizing the intended hardware-backed true random number generator, the affected firmware switched to a deterministic pseudo-random generator.

Investigation and Precautionary Measures

Galaxy reported that around 90% of the stolen Bitcoin remains unspent, providing investigators valuable time for monitoring. It is crucial for affected users to generate new wallet seeds and migrate their funds to secure addresses. Coinkite, the manufacturer of Coldcard wallets, has released firmware updates to fix the vulnerabilities.

Call to Action for Coldcard Users

Coinkite has strongly advised all Coldcard users to replace their wallet seeds following the installation of the updates, as previously generated seed phrases remain at risk. Users are encouraged to verify receipt addresses and conduct small test transactions to ensure security before transferring their full balances.