Coldcard Bitcoin Hack Horror: $111 Million Stolen, Victims Lose 1 BTC!
Amid a significant security exploit affecting Coldcard hardware wallets, U.S. spot Bitcoin ETFs attracted nearly $791 million in net inflows last week, demonstrating resilient institutional demand. Bitcoin's price held strong, rising despite the security breach and a delay in the Clarity Act. This dual narrative highlights the different risk profiles and growing diversification in Bitcoin investment avenues.
Last week presented a complex narrative for Bitcoin, characterized simultaneously by a significant security breach impacting hardware wallets and a robust surge in institutional capital inflows into U.S. spot Bitcoin Exchange-Traded Funds (ETFs). Despite the negative headlines surrounding the security incident, Bitcoin's price demonstrated resilience, trading higher.
A new analysis of Bitcoin theft reports revealed that a substantial amount of stolen funds originated from long-dormant wallets. Data from Galaxy Research's Alex Thorn, based on 250 victim reports, indicated that the typical stolen Bitcoin had remained untouched for an average of 3.5 years, with a striking 88% of pilfered funds being at least a year old. Individual victims reported a median loss of 1.022 Bitcoin and an average of 4.04 Bitcoin, with one individual losing as much as 58.97 coins. Losses per address ranged from a median of 0.014 Bitcoin to a mean of 0.212 Bitcoin. Hackers initially stole over $35 million in Bitcoin last Thursday, with confirmed losses escalating to $111 million by Friday, and Galaxy Research estimating total losses could exceed $130 million as vetting continues.
The root cause of these thefts was a critical firmware bug in Coldcard Mk3 devices, specifically affecting versions 4.0.1 and later, released since March 2021. This flaw caused the seed generation process to default to a weak software Pseudorandom Number Generator (PRNG) instead of the intended hardware true random number generator, thereby allowing attackers to potentially guess investor seed phrases. Coinkite, the maker of Coldcard, stated that the bug