Attention Bitcoin Users: Today’s Hack May Be Larger Than Expected—Here’s What to Do

Bitcoin hardware wallet manufacturer Coinkite has announced the discovery of a critical security vulnerability that could affect the security of seed expressions generated on some Coldcard Mk3 devices. The company advises users who may be at risk to immediately transfer their funds to a new and secure wallet.

According to Coinkite, the issue stems from the seed generation process on Coldcard Mk3 devices running firmware versions 4.0.1 to 5.0.3. Users who have previously generated seeds on these devices should consider all Bitcoin addresses associated with that same seed potentially at risk.

The warning comes amid ongoing investigations into an attack in which a large amount of $BTC was stolen from hundreds of single-signature Bitcoin wallets. While initial reports indicated approximately 594 $BTC were stolen, Galaxy Research’s broader analysis suggests that 1,196 wallets were completely emptied, with a total of 1,082.65 $BTC compromised. This amount was estimated to be worth approximately $70.2 million at the time of the transaction.

According to Galaxy Research, the wallets were emptied in just 41 minutes on July 30th. The fact that the same 30 sat/vB fee was used in all transactions and that no change was printed out for any transaction suggested that the transfers may have been carried out not manually by users, but by an automated tool scanning compromised private keys.

The stolen Bitcoins were reportedly consolidated into four different addresses, and so far, no activity has been observed from these addresses. It is noteworthy that the attack occurred approximately 30 hours before Coinkite publicly disclosed the Coldcard Mk3 vulnerability.

Security experts recommend that users of Coldcard Mk3 who have created a seed on the device no longer consider the old seed expression secure. Users are advised to create a new seed in a reliable and up-to-date hardware wallet, and then transfer all funds to this new address. Simply changing devices is not considered sufficient; the old seed expression should not be transferred to the new wallet.

*This is not investment advice.