Coldcard Hacker Moves $1.94 Million in Stolen Bitcoin
First transfer raises concerns about potential cash-out of stolen funds
1Hacker's First Move
A wallet linked to the Coldcard hack transferred 30.185 BTC (worth $1.94 million) to a new address on August 7. This marks the first movement of funds after weeks of inactivity, representing about 1.5% of the total 2,055 BTC stolen. Blockchain tracker Lookonchain highlighted the need for close monitoring as this transfer could signal the start of a cash-out process by the hacker.
2$100 Million Breach
Galaxy Research analysis reveals that a software vulnerability in Coldcard hardware wallets led to thefts from over 7,300 addresses totaling 1,596 BTC. With a suspected fourth attack wave, total losses could reach 2,055 BTC ($130 million). Before the recent transfer, 90% of stolen bitcoins remained inactive. This massive breach has raised serious concerns about hardware wallet security.
3Software Flaw Details
Toronto-based Coinkite disclosed that affected firmware since March 2021 used a deterministic pseudo-random generator instead of hardware-backed true random number generation. This flaw enabled hackers to reconstruct wallet seeds or private keys without physical access. The company urged users who generated seeds with vulnerable firmware to transfer funds to secure addresses or create new seeds.
4Cash-Out Process
Experts note that stolen crypto assets typically move through multiple wallets before being cashed out. The recent transfer might initiate this laundering process. While blockchain transparency allows tracking attacker addresses, details have been shared with US law enforcement and exchanges to identify final destinations. This coordinated effort aims to intercept the funds before liquidation.
5User Risks
Seed phrases generated with affected firmware continue to pose security risks despite updates. Coinkite strongly recommends replacing existing seeds, emphasizing that updates don't eliminate vulnerabilities in previously generated seeds. Galaxy Research stressed the importance of identifying additional attacker addresses to prevent further losses and aid recovery efforts.
6Industry Impact
This $100M+ breach has shaken confidence in hardware wallet reliability, particularly for long-term 'HODL' investors. Industry experts advocate for multi-layered security approaches in crypto asset storage solutions. The incident underscores the need for reevaluating security standards across the sector, with potential implications for insurance products and custody solutions.
7Legal Proceedings
Galaxy Research confirmed sharing details of attacker and victim addresses with US authorities, crypto exchanges, and cyber investigation teams. While efforts continue to track and recover stolen funds, the cross-border nature of blockchain complicates legal processes. International cooperation will be crucial in apprehending perpetrators and establishing legal precedents.
8Future of the Industry
This large-scale breach highlights the urgent need to revisit crypto security standards. Hardware wallet manufacturers may need to implement enhanced security measures. Users are advised to combine multi-factor authentication with cold storage solutions. Long-term, such incidents could accelerate regulatory developments in the cryptocurrency space.
Original article: News - Cryptonews — Coldcard Hackerı 1.94 Milyon Dolarlık Çalıntı Bitcoin'i Taşıdı