Thousands of Bitcoin Wallets Drained in Half-Hour Attack

The Bitcoin community is dealing with one of the most severe security incidents recorded in the field of cold wallets. During several waves of attacks, more than 1,367 bitcoins, worth about 88 million dollars, were stolen from 4,585 different addresses created using Coldcard hardware wallets from the Canadian company Coinkite.

The incident did not stem from a hack of the Bitcoin network itself, but from a flaw in the wallet's internal software, which caused some devices to generate private keys with an insufficiently high level of randomness. In simple terms, the code that was supposed to create a secret that is almost impossible to guess, in some cases created a more predictable secret, which could be reconstructed with the help of computing power and automatic scanning.

The damage continues to expand, and research companies warn that users who created wallets using vulnerable versions may still be exposed, even if their funds have not yet been stolen.

Hundreds of wallets were emptied within 25 minutes

The first wave of the attack was particularly fast and coordinated. Within just about 25 minutes, hundreds of bitcoins were stolen from separate wallets, with the transactions compressed into a small number of blocks on the network. The attacker likely scanned in advance for addresses that might be vulnerable, calculated the appropriate keys, and activated an automatic process to empty the wallets.

In the first stage, most of the stolen funds were concentrated in a small number of addresses, which made it relatively easy for blockchain researchers to track them, but later the method of operation changed.

In the third wave of the attack, about 208 additional bitcoins were stolen from 1,912 addresses, but this time the average theft amount per victim was much smaller. According to Galaxy Research, this may indicate that the attacker has already emptied the wealthier addresses and is now running scanners on every possible balance, even if it involves fractions of a bitcoin.

How did a software flaw make a cold wallet vulnerable?

To understand the failure, one must understand how a Bitcoin wallet is created. When setting up a new wallet, the device generates a backup phrase, known as a Seed phrase. From this combination of words, the private keys that allow control over the coins are derived.

The security of the system depends on very high randomness. The larger the space of possibilities, the harder it is for an attacker to guess the combination of words or the key.

According to the technical analysis published, a glitch in the Coldcard settings caused the hardware random number generator not to function as designed. Instead, the system relied on a weaker software generator, which received data such as the chip's serial number and the internal clock as a starting point.

These data are not truly secret. An attacker with appropriate knowledge can narrow down the range of possibilities, perform many calculations, and search for a match to existing addresses on the blockchain. According to reports, the bug entered the code in version 4.0.0, released in March 2021, and remained in other versions for years.

Not all models were exposed to the same level

The intensity of the exposure varies between different Coldcard models. In the Mk2 and Mk3 models, the effective level of randomness is estimated to have dropped particularly sharply. In newer models, such as the Mk4, Q, and Mk5, there is an additional security component that adds randomness to the process.

Coinkite claims that this component significantly improves protection. However, researchers presented a more cautious analysis, according to which even in the new models, there is a limitation in how the system processes the additional randomness.

This does not mean that every new device is hacked or that every Coldcard user will lose their money. But it does indicate that the scope of the exposure is not yet fully clear, and therefore users cannot settle for the assumption that their model is safe without checking how and when the wallet was created.

Not a hack of Bitcoin, but a failure in a product that is supposed to protect it

Despite the scale of the theft, it is important to clarify that the Bitcoin network itself is operating normally. The transactions were signed using valid private keys after the attacker likely managed to reconstruct them due to the weakness in the way they were created. From the perspective of the Bitcoin network, these are completely legal transactions.

The incident illustrates that self-custody does not end with the purchase of a hardware wallet. It also requires trust in the manufacturer, the code, the key generation process, and the user's ability to follow warnings and quickly switch to a new wallet if necessary.

In this sense, this attack is not just a theft of tens of millions of dollars. It is a painful reminder that even a cold wallet is not a magic solution, and that in a world where the user is their own bank, the responsibility for security does not disappear. It simply moves into their hands.