Just weeks after ZachXBTC attacked hardware wallet device issuers, calling it a “complete garbage for crypto use”. The Coinkite cold hardware wallet — Coldcard got exploited for around $40 million Bitcoins.
According to Galaxy, 1,082 Bitcoins worth $70.2 million was drained from 1,196 wallets about 30 hours before the Coldcard Mk3 vulnerability was disclosed.
The hack has reportedly resulted in around 500 Coldcard hardware wallets being drained. These wallets used mostly single-signature security and had been affected by a bug reported by Coinkite.
Coldcard is a bitcoin-only hardware wallet created by the Canada-based Coinkite that keeps private keys offline, uses dual secure elements, and supports air-gapped transaction signing.
Coinkite has put out a warning on its blog, cautioning users who generated a seed using a Mk3 on version 4.0.1 (March 2021) or any subsequent version that their funds may be at risk.
Following the blog post, Coinkite encouraged users to update to the latest firmware and must generate a new seedphrase, “Updating the firmware does not repair a seed that was generated by affected firmware. A new seed must be generated and the funds migrated to the new wallet.”
Coinkite has also listed a follow-up and a step-by-step guide for all users to help in a safe and seamless migration of funds.