Coldcard wallets face losses nearing $114 million due to recent attacks that exploit a firmware vulnerability.
Coldcard wallets have seen substantial losses, approaching $114 million, amid a series of attacks that have compromised Bitcoin addresses. Since July 30, around 1,816 bitcoin have been transferred from over 5,200 affected addresses, according to research findings.
Attacks Utilize Replace-By-Fee Feature
The recent attacks leverage Bitcoin's replace-by-fee feature, enabling victims to outbid attackers and reclaim their funds if they spot their coins in the mempool, the pool of unconfirmed transactions. Alex Thorn, head of firmwide research at Galaxy Research, highlighted this strategy, noting that it offers a narrow opportunity for victims to act quickly.
The attacks began with a significant sweep on July 30, resulting in the theft of 1,083 bitcoin from 1,196 addresses in just 41 minutes. Over the following weekend, the cumulative losses increased to 1,367 bitcoin across 4,585 addresses.
A firmware vulnerability, traced back to March 2021, allowed attackers to exploit predictable seed generation that used a flawed software randomizer rather than a hardware-based one, enabling easy replication of the keys. In response, Coinkite, the maker of Coldcard wallets, has issued emergency firmware updates and recommended users migrate their assets to wallets with newly created seeds.
Thorn emphasized the importance of prompt action for users, advising them to check their accounts and transfer any funds off compromised devices. He indicated that if the attack pattern persists, overall losses could reach approximately 1,816 bitcoin, nearly $114 million, from the impacted addresses.
Notably, these attacks affected blocks 960,778 to 960,792, where about 218 transactions targeted 462 victim addresses, significantly exceeding normal transaction rates. Each compromised bitcoin was redirected to new addresses lacking prior transactions, complicating potential tracing efforts. Importantly, the initial three attack waves did not target multisignature setups, which remain secure from the identified vulnerability.
