Coldcard's biggest security failure may have cost $70M

An attacker has drained over 1,000 bitcoin (approx worth around $70 million) from nearly 1,200 wallets that used Coldcard hardware to generate a key seed, Galaxy Research revealed on Friday. The figure is substantially higher than the initial estimates made by the company 24 hours earlier. The potential losses involve all Coldcard users who created a seed between March 2021 and the present date.

Galaxy Research estimates that 1,082.65 bitcoin were withdrawn from 1,196 addresses, with the majority of the funds moved between 01:10 and 01:50 UTC on July 30, in a 40-minute window. This number vastly exceeds the reported theft of 594 BTC ($38 million) from approximately 500 single-signature wallets. It happened within 40 minutes. Each of the affected addresses owned more than 0.15 BTC. Over 562 BTC were transferred to one particular address that has yet to see any transactions.

The report highlighted the work of Block’s engineering and security teams, which recognized a pattern in the movement of these funds. “The trail of on-chain transactions identified by other researchers, including Clay Garrett, correctly points to the thief. However, it does not identify the vulnerability that enabled this particular theft,” the company noted, warning that “future attacks could target any Coldcard address generated using the vulnerable firmware.”

… Continue reading the full article at the original source below.