Bitcoin thefts of more than $70 Million occurred yesterday. attack The thief, who exploited an error in Coldcard’s software system, reportedly sought help from a blockchain services company.
Clay Garrett writes about X Friday as an engineer for Block Payment Company. said that the provider — who he did not name at the request of the services provider — had been contacted after finding blockchain movements matched the “suspected workflow” Of the assailant
“During our investigation of the Coldcard drain yesterday, we identified an unusual pattern in the sweeps,” Garrett said.
“That pattern led us to a hypothesis that has since been confirmed: the operator used a paid account at a well-known blockchain-services provider to query the source addresses and perform other related activity during the sweeps,” Garrett added that authorities were notified.
Galaxy Digital’s research division also noted on X, that the thief displayed an unusual pattern in moving coins.
“The pattern tells us these were all the same attacker — it does not capture the attack itself, which looks the same as if a coin owner chose to move coins,” The company saidBitcoiners are advised to move their funds from Coldcard single-signature addresses into safe custody.
After over $35 million in Bitcoin was drained from wallets on Thursday, Coinkite said that a firmware bug in Coldcard Mk3 devices — starting with version 4.0.1 in March 2021 — caused seed generation to fall back to a weak software Pseudorandom Number Generator instead of the hardware true random number generator.
The attackers could brute-force the keys to many single-signature wallets, especially those without dice-rolling or with BIP 39 passphrases.
Coinkite announced that its entire line of models was vulnerable to thefts. So far, engineers have said that over $70,000,000 has been taken and warned of the possibility of more thefts. at risk.
It makes several Bitcoin products such as cold storage hardware wallets.
“This article is not financial advice.”
“Always do your own research before making any type of investment.”
“ItsDailyCrypto is not responsible for any activities you perform outside ItsDailyCrypto.”
Source: bitcoinmagazine.com
