Hackers continue to drain Coldcard Bitcoin wallets, with the total amount stolen now estimated to be standing at over $114 million.
A fourth wave of attacks likely started on Sunday evening, according to Galaxy Research’s Alex Thorn. Posting at around 7:50pm in New York, he revealed then that 388.9 Bitcoins worth over $29 million had been moved in new transactions that were highly likely to be part of the theft.
Hackers started by taking over $35 million in Bitcoin from wallets on Thursday. Coinkite, which makes Coldcard, said that a firmware bug in Coldcard Mk3 devices — starting with version 4.0.1 in March 2021 — caused seed generation to fall back to a weak software Pseudorandom Number Generator instead of the hardware true random number generator, allowing hackers to essentially guess investor seedphrases.
The theft continued throughout the weekend while Coinkite and other Bitcoiners urged Coldcard users to immediately move their funds.
Posting on X on Monday, Trezor’s Josef Tětek wrote that the biggest transaction in the ongoing theft so far was 51 Bitcoins.
Coinkite has since admitted all of its models were vulnerable following more thefts. Engineers have warned that all Bitcoin addresses related to Coldcard could be at risk eventually.
The company said Sunday that it was asking “hard questions about our company.”
“The last three days have been some of the hardest in this company’s history, and for a lot of the people reading this, they’ve been something much worse,” Coinkite said.
“Money that took years to save, gone. Trust that took years to build, broken. That impact is real, and for some, the damage is permanent.”
The company added that it had destroyed its remaining Coldcard inventory manufactured with the vulnerable firmware, and shipments of the product have been halted.
Coinkite makes a number of Bitcoin products, including the popular cold storage hardware wallets.
Engineers at payments company Block investigated the hack and reported that the hackers used a top blockchain services provider for help in moving the funds, and that they’ve contacted the provider and federal authorities with their findings.
