Bitcoin hardware wallet Coldcard shipped a faulty firmware build, and hackers are now draining wallets; Galaxy Research estimates $70M+ stolen (Shaurya Malwa/CoinDesk)

A firmware bug in the Coldcard Bitcoin hardware wallet has led to the theft of millions of dollars' worth of cryptocurrency. The issue, which dates back to a March 2021 integration error, allowed attackers to guess supposedly random seed phrases from outside the device, enabling them to drain funds from thousands of addresses. According to Galaxy Research, over 1,367 Bitcoin, worth approximately $88.6 million, has been stolen across 4,585 addresses.

The thefts began on July 30, with 1,082.65 Bitcoin, worth around $70.2 million, stolen from 1,196 addresses in a 41-minute window. Further waves of theft have been detected since then. The attacker targeted the largest balances first, with one victim losing around $1.8 million. Coinkite, the manufacturer of Coldcard, has confirmed the issue and shipped fixed firmware.

The incident has raised concerns about the safety of self-custody solutions, with some investors moving their holdings to exchanges in search of greater security. Daily exchange deposits of Bitcoin transfers over 10 BTC spiked to 7.3K BTC, the highest since February 6, following the hack.

Brief written by urgent.news from Techmeme, TechSpot, CoinDesk, Slashdot, The Hacker News — 5 reports on this story. Machine-written — may contain errors; check the original before relying on it.