Hackers steal over $130M by exploiting bug in offline hardware wallets

6 hours ago

Hackers are exploiting a flaw in Coldcard hardware wallets to steal cryptocurrency, with losses estimated at $130 million.
Over 200 crypto hacks have occurred in 2024, resulting in total losses exceeding $950 million, according to TRM Labs.
The vulnerability involves predictable seed phrase generation in Coldcard wallets, allowing hackers to brute-force passwords offline.
User Jonathan Goodman reported losing $1.6 million despite following security best practices, highlighting the flaw's severity.
Coinkite has issued an advisory urging users to update devices and migrate to new seed phrases to mitigate the risk.

Galaxy Research reports approximately $88.6 million stolen from 4,585 Coldcard addresses across three waves of theft.
The exploit, stemming from a March 2021 firmware flaw that caused weak seed phrase randomness, is ongoing and likely LLM-orchestrated.
Every single-signature Coldcard address created after the vulnerable firmware version is expected to be drained eventually.

A Coldcard firmware flaw enabled attackers to steal nearly 600 bitcoin worth about $38 million, one of the biggest failures of Bitcoin self-custody.
Security experts warn that the hack underscores growing operational risks in self-custody as cyber threats evolve, including software, hardware, and supply-chain risks.
The incident may accelerate the shift toward regulated custodians and spot Bitcoin ETFs, with some analysts advising investors to hold funds on exchanges or ETFs instead of managing private keys.

Block's Bitcoin Engineering and Security teams identified vulnerabilities in COLDCARD firmware allowing Bitcoin theft.
Vulnerability stems from an RNG integration error where ngu.random uses a deterministic Yasmarang fallback instead of the hardware RNG.
Affected devices include Mk2/Mk3 v4 (no secure reseed), Mk4/Q/Mk5 (limited 32-bit reseed), while Mk1 and older firmware are unaffected.

Coinkite warns that COLDCARD Mk3 firmware versions 4.0.1 to 5.0.3 may have vulnerable wallet seeds, putting Bitcoin at risk.
The issue does not affect COLDCARD Mk4, Mk5, or Q devices; users with a BIP-39 passphrase face minimal risk.
Users are urged to migrate to a new seed generated on unaffected hardware, verifying backups and testing transfers before moving large balances.

A vulnerability in a March 2021 Coldcard firmware release enabled attackers to drain bitcoin from thousands of wallets by reproducing keys generated with weak software-based randomness.
Three distinct attack waves have swept 1,367 bitcoin (nearly $89 million) from 4,585 addresses, with the latest wave targeting smaller balances and using more complex, harder-to-trace transaction patterns.
Galaxy Research believes each wave is the work of a single operator but cannot determine if the same attacker is behind all three due to blockchain limitations.

Galaxy Research reports approximately $88.6 million stolen from 4,585 Coldcard addresses across three waves of theft.
The exploit, stemming from a March 2021 firmware flaw that caused weak seed phrase randomness, is ongoing and likely LLM-orchestrated.
Every single-signature Coldcard address created after the vulnerable firmware version is expected to be drained eventually.

A Coldcard firmware flaw enabled attackers to steal nearly 600 bitcoin worth about $38 million, one of the biggest failures of Bitcoin self-custody.
Security experts warn that the hack underscores growing operational risks in self-custody as cyber threats evolve, including software, hardware, and supply-chain risks.
The incident may accelerate the shift toward regulated custodians and spot Bitcoin ETFs, with some analysts advising investors to hold funds on exchanges or ETFs instead of managing private keys.

Block's Bitcoin Engineering and Security teams identified vulnerabilities in COLDCARD firmware allowing Bitcoin theft.
Vulnerability stems from an RNG integration error where ngu.random uses a deterministic Yasmarang fallback instead of the hardware RNG.
Affected devices include Mk2/Mk3 v4 (no secure reseed), Mk4/Q/Mk5 (limited 32-bit reseed), while Mk1 and older firmware are unaffected.

Coinkite warns that COLDCARD Mk3 firmware versions 4.0.1 to 5.0.3 may have vulnerable wallet seeds, putting Bitcoin at risk.
The issue does not affect COLDCARD Mk4, Mk5, or Q devices; users with a BIP-39 passphrase face minimal risk.
Users are urged to migrate to a new seed generated on unaffected hardware, verifying backups and testing transfers before moving large balances.

A vulnerability in a March 2021 Coldcard firmware release enabled attackers to drain bitcoin from thousands of wallets by reproducing keys generated with weak software-based randomness.
Three distinct attack waves have swept 1,367 bitcoin (nearly $89 million) from 4,585 addresses, with the latest wave targeting smaller balances and using more complex, harder-to-trace transaction patterns.
Galaxy Research believes each wave is the work of a single operator but cannot determine if the same attacker is behind all three due to blockchain limitations.

Hasty Briefsbeta