A critical security vulnerability has been discovered in Coldcard hardware wallets, leading to the theft of 594.48 BTC, worth an estimated $38.3 million, from over 500 distinct Bitcoin addresses. This breach has sparked widespread concern among cryptocurrency users, challenging the trustworthiness of widely-utilized hardware wallets for securing digital investments.
How did this happen?
Security firm Block Security has unveiled that shortcomings in Coldcard’s firmware made many of its models vulnerable to automated hacks. This flaw, which has been present since March 2021, impacts a range of Coldcard products, including Mk2, Mk3, Mk4, Q, and Mk5, subjecting them to dangerous exploits due to insufficient seed phrase security.
The primary issue revolves around inadequacies in the seed phrase generation process within the Coldcard system. Older model hardware experienced failures in generating truly random numbers, while newer models suffered from truncation of critical entropy data during key generation, leaving them susceptible to attack.
These vulnerabilities allowed attackers to substantially reduce the possible permutations for seed phrases, facilitating brute-force access to private keys with conventional computing power. Consequently, cybercriminals successfully orchestrated an automated attack, consolidating the compromised funds into a single Bitcoin address.
Impact and response?
Prominent voices in the cryptocurrency domain, such as Bitcoin developer Peter Todd, have responded with grave concern. Todd has persistently cautioned against relying on hardware wallets, citing their opaque codebases and susceptibility to supply chain manipulation.
“I’ve always been skeptical of hardware wallets. You pay a lot of money for a device running code that few people will ever look at, on hardware that could be backdoored with a supply chain attack.”
The breach underlines the necessity for thorough external examination and rigorous auditing of security protocols in hardware devices, according to Todd. He proposes employing end-to-end deterministic testing techniques and suggests physical randomization methods to bolster randomness in seed phrase creation.
The incident extends beyond ordinary single-key wallets and also affects multisignature wallets if all cryptographic keys were derived using the vulnerable Coldcard devices. The problem arises during the initial seed phrase creation, suggesting that merely exporting these seeds to a new wallet cannot resolve the risk. Immediate actions are imperative to safeguard assets through newly generated keys.
- Users must create unique seed phrases on independently verified devices.
- Transferring Bitcoin holdings to new, secure wallet addresses is crucial.
- Inclusion of a BIP-39 passphrase adds an additional safety layer.
This unsettling development raises serious questions about the future security measures necessary for protecting digital assets. With more calls for heightened scrutiny and innovative solutions, the need for reliable cryptographic safety is more pressing than ever.
