Topline
A software flaw in popular cryptocurrency storage devices allowed “numerous” hackers to steal more than $100 million in bitcoin, and more attacks targeting digital assets are ongoing, according to a crypto research firm.
Key Facts
Galaxy Research said Monday it identified 1,596 bitcoin, valued at about $102 million as of Tuesday, that had been stolen from more than 7,300 crypto wallets across three confirmed waves of theft and 14 smaller incidents.
A firmware flaw in Coldcard hardware wallets—a small, secure device that stores the secret recovery phrase used to secure bitcoin—left the wallet seeds weak enough for hackers to guess, Galaxy Research found, and Coldcard maker Coinkite confirmed last month a bug affected some firmware versions before releasing a fix.
Coinkite warned that updating the firmware would not repair compromised seeds, and that users should migrate their funds to a newly generated wallet.
About 600 hacked wallet addresses belonged to federal investigators, industry compliance firms and cyber investigators, according to Galaxy Research.
what to watch for
Galaxy Research said victim addresses are still being compiled, and including suspected losses, the total could reach about 2,000 bitcoin, or roughly $130 million.
tangent
The price of bitcoin stumbled to a three-week low on Friday, falling to around $62,700, though the leading cryptocurrency has since regained some ground, rising to just over $64,000 on Tuesday. That decline came after Strategy, the largest institutional holder of bitcoin, announced plans to offload $5 billion worth of the cryptocurrency. The sale is “appropriate for the company,” Strategy CEO Phong Le said, adding it would allow the company to build up its cash reserves and potentially fund stock repurchases.
key background
A Coldcard wallet generates a “seed,” or a string of random words that controls access. The randomness of the phrases is meant to be unpredictable, though the software bug present in Coldcard firmware—dating back to March 2021—meant the device was producing seeds with less randomness than advertised. That allows hackers to systematically guess those phrases and then drain crypto wallets.
