Hardware Wallet Breach at Coinkite Causes $130 Million in Losses

A firmware vulnerability in a hardware wallet used to store Bitcoin led to about $130 million in losses.

Bloomberg reported on August 6 that hackers exploited a firmware flaw in Coldcard devices made by Canadian hardware wallet maker Coinkite Inc.

The attackers exploited a bug in certain firmware versions that reduced the randomness of seed phrases. Investigators found that this allowed them to infer users' private keys and steal Bitcoin without direct access to the Coldcard devices.

Coinkite said it had used artificial intelligence to review its core codebase but did not identify the vulnerability in advance.

One victim, UK resident Tim Ram, lost two Bitcoin worth about $130,000. He said the theft was especially shocking because he believed he had followed all the proper security procedures.

Christian McClure, who runs a restaurant in Colorado, also lost about $6,000 worth of Bitcoin that he had accumulated over six years. He said the incident felt like a betrayal because he thought he had taken every necessary precaution.

The incident is fueling debate over the safety of self-custody in digital assets. Security expert David Schwed said users who simply want exposure to cryptocurrencies may have better options than self-custody.

Vincent Boudon, Ledger's head of product security, disputed that view. He said the incident was not a problem with cold storage itself and that cold storage remains the safest method if cryptography is properly implemented.

According to TRM Labs, losses from cryptocurrency hacks totaled $972 million in the first half of this year, down from $2.3 billion a year earlier. Even so, the number of hacking incidents rose to a record 207 for any first-half period.