A significant attack on Bitcoin cold wallets has resulted in the theft of approximately 1,367 bitcoin, valued at nearly $89 million, from over 4,500 addresses. The ongoing assault, which has been linked to vulnerabilities in Coldcard hardware wallets, has raised alarms in the crypto community as reports of the attack spread. According to Galaxy Research, the attack has unfolded in three distinct waves, with the most recent sweep targeting smaller balances and employing more complex transaction patterns to evade detection.
Attack Details
The first wave of the attack occurred on July 30, draining around 1,083 bitcoin from 1,196 addresses in just 41 minutes. Subsequent waves have been less aggressive, with the latest sweep extracting about 208 bitcoin from 1,912 addresses. Analysts believe that each wave may be the work of a single operator, although it remains unclear if all three waves are coordinated. The vulnerabilities stem from a March 2021 firmware release that allowed attackers to exploit weak randomness in key generation, enabling systematic wallet draining.
Coinkite, the company behind Coldcard, has issued warnings and emergency firmware updates for affected devices. CEO Rodolfo Novak emphasized the urgency for users to migrate their funds immediately. Samson Mow, CEO of Jan3, echoed this sentiment, urging users to act quickly to protect their assets.
Related coverage: Bitcoin Rises Above $65,000 Amid Crypto Market Recovery.
The attack is likely to create volatility in the cryptocurrency market, particularly affecting Bitcoin prices as investors react to the security concerns surrounding Coldcard wallets. The incident may lead to increased scrutiny of hardware wallet security, impacting related sectors in the crypto space.
Watch for further updates from Coinkite regarding the effectiveness of their firmware updates and any potential new vulnerabilities that may be discovered.