Researchers from Galaxy Digital’s analytics division, Galaxy Research, have scrutinized a recent Coldcard wallet security breach, uncovering the breach of 1,196 wallet addresses that lost 1,082.65 Bitcoin, equivalent to roughly $70.2 million during the time of the transactions.
What Did On-Chain Analysis Discover?
The analysis revealed the path of the stolen Bitcoin between 1:10 AM and 1:51 AM UTC on July 30, tracing movements across nine blockchain blocks. Notably, these suspicious activities took place about 30 hours before Coldcard issued its first alert to users about the security concern. This investigation was initiated after initial insights from Rob Hamilton, CEO and co-founder of AnchorWatch, who detected nearly 594.48 Bitcoin moving through numerous transactions.
Further examination by Galaxy researchers identified a unique transaction behavior among the compromised wallets. This included consistent transaction fees and the absence of change outputs, revealing a coordinated pattern that helped pinpoint the initial breach.
“The initial attack activity is identifiable on-chain through this pattern, but future attacks targeting Coldcard-generated addresses may not follow the same fingerprint,” noted Galaxy Research.
Experts caution that while this transaction pattern has aided in tracing the current breach, similar vulnerabilities may arise with different characteristics, complicating future detection efforts.
How Did Coinkite Respond?
Rodolfo Novak, co-founder of Coinkite, accepted responsibility for the security gap through a public announcement. Coinkite has since issued a hotfix, addressing the software glitch responsible for the vulnerability. However, Novak stressed that firmware updates alone do not immune seeds created under the compromised versions. Users are advised to secure their funds by setting up new wallet seeds.
Novak urged users with affected firmware to move their funds to new seeds, stating that the hotfix alone is insufficient for complete security.
This situation has intensified the focus on cold wallet security practices and the necessity for quick, transparent responses. Experts advise on the importance of adhering to manufacturer guidelines and staying informed about updates to counter future vulnerabilities.
Key points from this incident include:
- An identified pattern of consistent transaction fees.
- Initial transactions lacked change outputs.
- Coldcard released a hotfix addressing the flaw.
- Users must create new wallet seeds for maximum safety.
Amid changing dynamics in the crypto landscape, the Coldcard incident underscores the vitality of adopting proactive security measures and ensuring transparency. Enhanced monitoring, combined with open communication, is crucial for both safeguarding assets and maintaining user trust. Furthermore, platforms bridging traditional and digital finance highlight the importance of diversification and risk management in cryptocurrency use.
