Coldcard breach: How hackers stole $89M from Bitcoin's 'safest' storage
What's the story
Nearly 1,367 Bitcoins, worth some $89 million, have been stolen from as many as 4,585 offline wallets in a hack that has rocked the crypto world. The theft was carried out by exploiting a vulnerability in Coldcard hardware wallets' offline key generation system. Galaxy Research's mapping shows that the attack was conducted in multiple waves, with the third wave of thefts reported early Sunday.
Attack strategy
Understanding the attack
Unlike typical cybercrimes where an exchange is hacked or a private key compromised, this attack targeted devices that are not directly connected to the internet.
When a wallet is created, its device generates an unpredictable number called the seed. This seed forms the basis for every address and private key derived from it using fixed public rules.
However, an internal build setting in Coldcard's firmware instructed it to skip its hardware random number generator and use basic software substitute instead.
Exploit details
Key generation could be predicted on older MK2, MK3 models
The software substitute used in Coldcard's firmware was seeded with the chip's serial number and clock registers, making it possible for an attacker to narrow down or reproduce these values using their own device.
This made the range of possible keys countable instead of astronomically large.
Investigators found that key generation could be predicted on older MK2 and MK3 models of Coldcard wallets.
Risk assessment
Likely generated candidate seeds on their own hardware
The attacker likely generated candidate seeds on their own hardware, derived the addresses each seed would produce, and checked those against the public blockchain. This process was detailed in a Galaxy study.
While Coldcard's maker has warned that only MK3 owners are affected, an investigation suggests that MK2, MK4 Q, and MK5 models may also be at risk.
Provider involvement
Blockchain data provider was unknowingly used in the attack
The attacker used a popular blockchain data provider to query the source addresses during the theft.
The provider's internal logs matched with what investigators described as "extraordinary specificity," suggesting they had been providing routine blockchain services to requests that gave no indication of their malicious purpose.
This incident highlights how quickly cybersecurity threats are evolving in today's digital landscape.