The stolen cryptocurrency was valued at about $38 million when the coordinated transactions occurred on July 31. Claims circulating on social media that the loss has exceeded $88 million could not be independently confirmed through blockchain data or disclosures available by early August.
The attacker emptied funds from roughly 500 wallets during a highly organised sweep lasting about 25 minutes. More than 1,300 unspent transaction outputs were transferred through hundreds of transactions spanning three Bitcoin blocks, indicating that the operation had been prepared and automated before it began.
Around 562 bitcoin was later consolidated into a single address. The concentration of the funds has made the stolen assets easier to monitor, although Bitcoin transactions cannot normally be reversed once confirmed on the blockchain.
Investigations have linked the theft to weaknesses in the process used by some Coldcard devices to generate wallet recovery phrases. These phrases, commonly consisting of 12 or 24 words, serve as the master credentials controlling the cryptocurrency held in a wallet.
Coldcard devices are designed to generate recovery phrases using random data from specialised hardware. A firmware defect, however, caused certain devices to rely on a less secure software-based source of randomness. Information used by that fallback process included predictable or discoverable device data, sharply reducing the number of possible recovery phrases an attacker needed to test.
The problem appears to have entered the firmware during March 2021 and remained undetected for more than five years. Coldcard Mk3 wallets that generated recovery phrases using affected firmware face the clearest risk. Seeds created on later models may also require replacement, depending on the device and firmware version used at the time.
Installing corrected firmware does not automatically secure an existing wallet. A recovery phrase created through the defective process remains vulnerable even after the device is updated or the phrase is imported into another manufacturer’s wallet.
Users who may be affected have therefore been advised to create entirely new recovery phrases using corrected software and transfer their bitcoin to new addresses. Moving the same phrase to another device does not remove the weakness because control of the funds remains tied to the original seed.
Recovery phrases strengthened during creation with sufficient independently generated randomness, including carefully performed dice rolls, may have additional protection. Security specialists have nevertheless urged users to migrate their holdings rather than assume supplementary steps were completed correctly.
The victims shared several characteristics. The affected wallets used single-signature arrangements, meaning one private key was sufficient to authorise a transaction. Many had remained inactive for years, while each contained enough bitcoin to justify the computational cost of identifying and draining it.
The pattern suggests the attacker may have reconstructed vulnerable recovery phrases in advance, identified their associated addresses on the public blockchain and waited until a large set of targets could be emptied simultaneously. The speed of the transfers reduced the opportunity for users or security teams to react.
Coldcard is produced by Toronto-based Coinkite and is built exclusively for Bitcoin. Its products have gained support among technically experienced holders because they allow transactions to be signed without maintaining a permanent connection to an internet-enabled computer.
The incident does not indicate a failure of Bitcoin’s underlying cryptography. Instead, it demonstrates how implementation errors can weaken the systems responsible for creating and safeguarding private keys, even when the blockchain itself continues to operate as intended.
The disclosure has also renewed debate over the trade-offs between self-custody and professional custody. Hardware wallets allow owners to avoid relying on exchanges, banks or investment managers, but users assume responsibility for device selection, software updates, backups and transaction security.
Large holders are increasingly being encouraged to use multisignature arrangements requiring approval from two or more separate keys. Using devices from different manufacturers can further reduce the danger that one firmware defect will compromise every key protecting a wallet.
Arabian Post – Crypto News Network
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
