08/02 update below. This post was originally published on July 31
Bitcoin and crypto holders have been left reeling by an attack on hardware wallet Coldcard that’s seen around $40 million worth of bitcoin stolen.
Sign up now for CryptoCodex—A free crypto newsletter that will get you ahead of the market
The bitcoin price has dropped in the hours since the attack was discovered but it remains above its key $60,000 per bitcoin support level.
Now, fears are swirling that news of the attack could drive the bitcoin price lower, potentially sending it crashing under the $58,000 level it fell to at the end of June.
Sign up now for the free CryptoCodex—A daily five-minute newsletter for traders, investors and the crypto-curious that will get you up to date and keep you ahead of the bitcoin price and crypto market swings
The bitcoin price is on the verge of a crash after a cold hardware wallet vulnerability was discovered.
Getty Images
Panic swept the bitcoin and crypto community last night after reports spread that almost 600 bitcoin worth around $40 million was stolen from hundreds of separate wallets that their owners had thought were secure.
08/02 update: An unprecedented attack on hardware wallets made by Coldcard has resulted in around 1,200 bitcoin addresses being drained of more than 1,000 bitcoin worth about $70 million, according to Galaxy Research analysts.
After the initial attack was seen targetting certain Coldcard Mk3 wallets, the company behind the device, Coinkite, later expanded its warning to users to include certain Mk4, Mk5 and Coldcard Q firmware versions, releasing an emergency firmware update for all affected models.
Panic has spread that all Coldcard wallets could be at risk, with waves of attacks continuing.
“If you’re using a Coldcard, any version firmware or MK, migrate your funds immediately,” Jan3 chief executive Samson Mow posted to X.
“If you know someone who is, let them know ASAP … Attacks are ongoing so do it quickly,” Mow wrote, adding his own Aqua wallet can be used “until you get a new” hardware wallet.
Coinkite chief executive Rodolfo Novak, using the @NVK handle on X, has issued an apology, saying the company has taken “full accountability for the firmware bug” and acknowledging that its review process had failed to catch it.
“If you know anyone who owns a Coldcard, please make sure they see this,” Novak wrote. “Some affected users may not be watching social media right now, and every hour matters. We do not store customer information, and would appreciate all assistance in reaching affected users.”
Meanwhile, reports have emerged of a minor vulnerability affecting the Bitkey bitcoin hardware wallet developed by Jack Dorsey’s Block payments company.
“Sharing our initial findings on a reported vulnerability. Our recommendation is to continue to use your Bitkey normally,” Bitkey developer Clay Garrett posted to X.
“The reported vulnerability would require exceptional circumstances to exploit, and can only occur at a specific narrow time during inheritance setup. Even if an attacker was able to exploit this vulnerability, they would not have enough cryptographic material to access funds.”
One pseudonymous X user called the wave of hardware wallet attacks, “the AI reckoning,” adding that “basically, what’s happening is Kimi K3 is finding critical vulnerabilities in a bunch of wallets right now,” referring to the recent open-weight, artificial intelligence model released by China-based artificial intelligence company Moonshot in July.
“It is crazy to see this unfold in real time though,” the X user with the handle @Wicked posted.
In a matter of minutes, attackers drained some 500 Coldcard hardware wallets that used mostly single-signature security and had been affected by a bug that meant the wallets used predictable software-based key generation seeded by chip data rather than a sophisticated randomness generator.
Coldcard is a bitcoin-only hardware wallet created by the Canada-based Coinkite that keeps private keys offline, uses dual secure elements, and supports air-gapped transaction signing.
“Out of an abundance of caution, Coinkite is warning all users who generated a seed using a Mk3 on version 4.0.1 (March 2021) or any subsequent version that their funds may be at risk,” Coinkite developers wrote in a blog post.
“We were unaware of the bug until today,” they added, advising users to “proceed calmly, verify every step,” and move their funds to a new wallet. “Updating the firmware does not repair a seed that was generated by affected firmware. A new seed must be generated and the funds migrated to the new wallet … When migrating to a new key, calm and care should be applied. Rushing a wallet migration can create a more immediate risk than the issue you are trying to address.”
The threat has spread to other hardware wallets due to the ability of wallets to import seeds.
“If you exported a seed generated in a vulnerable Coldcard, moving it to another wallet, then that same insecure seed is still affected,” security researchers with Jack Dorsey’s Block wrote in a blog post.
Sign up now for CryptoCodex—A free crypto newsletter that will get you ahead of the market
The bitcoin price has stabilized in recent weeks, however, some now fear a further bitcoin price is looming.
Forbes Digital Assets
The attack has fed fears that the widespread adoption of artificial intelligence tools will lead to the volume of attacks on bitcoin and crypto software increasing.
“The exploit is out in the wild, public attention is on it, and everybody has access to frontier LLMs [large language models],” a pseudonymous onchain analyst and prominent crypto skeptic using the handle @Pledditor posted to X. “I imagine there are dozens of hacking teams now researching how to exploit this. You are in a race against time.”
“I have a very bad feeling AI was involved in this unfolding situation with Coldcard’s being drained,” X user Cobra, the pseudonymous co-owner and administrator of the prominent Bitcoin.org website, posted to X, adding bitcoin could collapse under $60,000 as a result.
“This will bring us down to $58,000 when the media get a hold of it,” Cobra posted.