- Coinkite published a security advisory and shipped emergency firmware on 31 July after a defect left Coldcard seeds with as little as 40 bits of entropy instead of the expected 128.
- Galaxy Research says about 1,367 BTC, roughly US$88.6 million, has been drained from 4,585 addresses, starting with 1,196 addresses emptied in 41 minutes on 30 July.
- Bitcoin transfers under 1 BTC reached 39,600 BTC on Friday, the highest daily total since November 2022, according to CryptoQuant.
CryptoQuant head of research Julio Moreno said 39,600 BTC changed hands in transfers under 1 BTC on Friday, the most in a day since 16 November 2022. “The Bitcoin plebs had not moved this amount of BTC in a day since the FTX collapse.”
Moreover, Coinkite acknowledged a flaw in how its Coldcard hardware wallets generated Bitcoin seeds and shipped emergency firmware for every affected model on 31 July, after researchers began mapping a series of thefts from Coldcard-generated addresses.
A firmware change made in March 2021 routed seed generation to a software fallback instead of the device’s hardware random number generator, Coinkite said in a technical post.
Seeds made on Mk2 and Mk3 devices without dice rolls ended up with roughly 40 bits of randomness, and those on the Mk4, Mk5 and Q with about 72 bits, against the 128 bits the devices were meant to produce.
That is few enough for keys to be guessed by brute force. The fallback code had sat in upstream software since May 2018. Security researchers at Block traced the fault to a production build setting.
Read more: Brother of Olympian Raygun Jailed Over $180,000 Linked to Alleged Crypto Scam
What Does Coinkite Say?
The advisory covers Mk2 and Mk3 firmware 4.0.1 through 4.1.9, Mk4 and Mk5 versions before 5.6.0, and the Q before 1.5.0Q. “Do not generate a new seed on any of these models until the update is installed,” it says. Updating does not repair a seed already created on the affected firmware, so owners have to generate a new one and move their coins.
According to Coinkite, two things can spare a wallet: feeding in at least 50 fair dice rolls during setup, or using a strong, unique BIP-39 passphrase.
Galaxy Research put the running tally at about 1,367 BTC, roughly US$88.6 million (AU$125.8 million), across 4,585 addresses, after 1,082 BTC left 1,196 addresses in a 41-minute sweep on 30 July.
Read more: Nansen CEO Bets AI Trading Agents Will Outnumber Human Traders Within Two Years
The post Bitcoin ‘Plebs’ Rush to Move Funds as Suspected Coldcard Hack Sparks Self-Custody Fears appeared first on Crypto News Australia.
