CZ Cautions Bitcoin Holders Following $70 Million Coldcard Breach

Significant Coldcard Breach Raises Alarm

Changpeng "CZ" Zhao, the founder of Binance, has alerted cryptocurrency holders about the vulnerabilities associated with hardware wallets following a major breach involving Coldcard devices. This incident has reportedly led to the loss of approximately 1,082.65 Bitcoin, valued at around $70.2 million, across 1,196 addresses.

Vulnerability Details

The warning stems from a firmware flaw in Coldcard devices produced by Coinkite, which dates back to a March 2021 update. This flaw allowed the generation of seed phrases from a software fallback rather than the secure hardware random-number generator, increasing the risk of private key exposure. Zhao emphasized that while hardware wallets are considered secure, they are not without flaws, stating, “Nothing is 100%.”

Recommendations for Users

In a post on X, Zhao advised users to diversify their holdings across multiple wallets to reduce risk, although he acknowledged that this method has its limitations. He reinforced the importance of vigilance in protecting digital assets, urging users to “Stay SAFU!”

Extent of the Theft

The breach's impact has escalated from initial estimates of around 594 BTC, or $38 million, to the current figure of over 1,082.65 BTC due to further investigations. Galaxy Research noted that the theft occurred in a swift 41-minute window on July 30, with transactions showing characteristics typical of automated exploitation rather than individual user actions. The stolen funds were rapidly consolidated into a few addresses, which have remained inactive since the incident.

Coinkite has responded by issuing emergency hotfixes and advising affected users to create new seed phrases to safeguard their assets.