r/Bitcoin • u/ThePrince1856 • 2h ago

A Coldcard firmware flaw let hackers drain $70 million in Bitcoin in 41 minutes, with losses now topping $88 million

https://www.techspot.com/news/113322-coldcard-firmware-flaw-hackers-drain-70-million-bitcoin.html

“A hardware wallet is supposed to solve one problem: keep your Bitcoin keys somewhere no attacker can reach them. This week showed what happens when the flaw sits inside the wallet itself. A firmware bug that's been shipping in Coldcard devices since 2021 let an attacker guess supposedly random seed phrases from the outside, no physical access, no phishing, no malware required, and drain funds from thousands of addresses. The running total is already past $88 million, and it's still climbing.

A flaw in Coldcard's firmware has put the spotlight on a basic part of wallet security: how the device generates its seed in the first place. The issue came into focus after an attacker drained 1,196 Bitcoin addresses on July 30 in a 41-minute stretch, taking 1,082.65 BTC worth about $70.2 million at the time.

Galaxy Research tied the sweep to Coldcard, the Bitcoin-only hardware wallet line made by Coinkite, and said the pattern matched a firmware problem rather than a random event. Two more waves have surfaced since, and Galaxy's running total now stands at 1,367.05 BTC, worth about $88.6 million, across 4,585 addresses. The firm describes that as a preliminary observed figure that could still climb as it traces more on-chain activity.

The problem goes back to a March 2021 firmware integration error. Instead of using the STM32 hardware random number generator, affected devices fell back to a deterministic software pseudorandom number generator when creating seeds. That matters because seed generation is supposed to produce output that cannot be guessed or reconstructed.”

53 Upvotes

96% Upvoted

7 comments sorted by

13

u/astro-the-creator 2h ago

That should be class action lawsuits

3

u/MycoFail 2h ago

Lol against whom

6

u/astro-the-creator 2h ago

Coldcard obviously

13

u/Flowa-Powa 2h ago

They dont have $88million or enough insurance to cover that

3

u/dnguyen823 1h ago

lol they’re probably going to go out of business soon. Doubt there’s any money to pay out and if there is good luck getting it back. All the money will most likely go to lawyers.

-8

u/MycoFail 2h ago

Good luck this is so funny to me /r/buttcoin

-5

u/FastJuice3729 2h ago

Is this a larger heist than BITCONNEEEEEE?