Hackers steal over $130M in cryptocurrency from offline hardware wallets
What's the story
A group of hackers has exploited a vulnerability in offline hardware wallets, stealing over $130 million in cryptocurrency, according to Galaxy Research. The attacks have mainly targeted Bitcoin users using the Coldcard wallet by Coinkite. Blockchain security firms monitoring these heists suspect multiple hacker groups are behind this massive theft.
Security breach
How hackers exploited the vulnerability
Coldcard wallets are designed to store cryptocurrency securely by keeping the secret key or seed phrase offline.
This "cold" storage method is considered safer than "hot" wallets connected to the internet through apps, browser extensions, and commercial crypto exchanges like Binance or Coinbase.
However, hackers have discovered a flaw in how these wallets generate users' seed phrases, making them predictable and vulnerable to brute-force attacks.
User impact
Users devastated by losses
The vulnerability in Coldcard wallets has left many users devastated.
One user, Jonathan Goodman, claimed to have lost $1.6 million from his Coldcard wallet despite taking all possible precautions like never sharing his seed phrase or connecting his devices to the internet.
He lamented that "None of it mattered. All because the hardware that created the seed phrase originally had one line in their code from 2021 that had a vulnerability."
Company action
Coinkite issues advisory for users
In light of the ongoing attacks, Coinkite has issued an advisory warning users about the vulnerability in Coldcard wallets.
The company has urged its users to update their devices and "migrate" to a new seed phrase for added security.
However, many users continue to reel from the massive thefts that have already occurred due to this security flaw.