Coldcard Bitcoin Wallet Users Urged to Act Now: $114 Million at Stake
In a critical security alert, Coldcard wallet developers are urging users to take immediate action to protect their Bitcoin funds. The company has issued a stark warning, emphasizing the urgency of the situation as an exploit has already drained a staggering $114 million from self-custodied wallets.
The vulnerability affects specific Coldcard devices and firmware versions, posing a significant risk to users' Bitcoin holdings. The flaw, dormant in the firmware since 2021, allows attackers to guess poorly randomized seed keys and drain funds without ever touching the device. This is a critical issue, especially for those who have not been actively monitoring their wallets.
Coldcard's advisory highlights the need for swift action. Users are advised to migrate their funds, upgrade their devices, generate new seeds, and carefully move their funds to a secure location. The company stresses that this is not a precautionary measure but a critical response to an ongoing threat.
The exploit has already resulted in substantial losses, with a possible fourth wave of sweeps taking approximately 449 BTC from 709 addresses. The cumulative losses have risen to an estimated $114 million, underscoring the severity of the situation.
Coldcard's Mk3, Mk4, Mk5, and Q devices are affected, with firmware versions 4.0.1 or later for Mk3 and older firmware versions for the other models requiring immediate attention. Coinkite has confirmed that wallets created using the dice-roll option are safe, as they never interacted with the broken code.
This incident serves as a stark reminder of the importance of secure self-custody practices in the cryptocurrency space. Cybersecurity expert Vincent Bouzon from Ledger emphasizes that every wallet relies on a root secret generated from high-quality entropy, which must be anchored in secure hardware. He warns that software wallets on non-secure hardware are riskier, and centralized exchanges do not provide true ownership.
Despite the alarming nature of the alert, Bitcoin's price has remained relatively stable, trading near $63,800 in early U.S. hours. However, the situation underscores the need for users to take proactive measures to safeguard their digital assets.
As the cryptocurrency market continues to evolve, incidents like this highlight the importance of staying vigilant and implementing robust security measures. Coldcard's prompt action and user advisory demonstrate the critical role of developers in ensuring the safety of their users' funds.
