Large bitcoin theft shakes the myth of the offline wallet

An attack on Coldcard hardware wallets, made by the Canadian company Coinkite, has taken around 1,600 bitcoin from a little over 7,300 addresses. The value exceeds a hundred million dollars, and it ranks among the most serious incidents ever recorded in self-custody of cryptocurrency.

The attackers exploited a five-year-old vulnerability in the process that generates security keys.

The blow lands on the part of the sector considered most solid. So-called cold devices keep private keys off the network, with no internet connection, and were for that reason regarded as the most reliable option compared with always-connected wallets or exchange platforms.

The protocol is not at fault

Dominic Weibel, head of research at Bitcoin Suisse in Zug, told the AWP news agency that cold storage has long been seen as a kind of cure-all, particularly after the collapse of FTX highlighted the counterparty risks of centralised custody.

The attack did not target the Bitcoin protocol, however. It exploited a specific flaw in the creation of recovery phrases for certain firmware versions. The system used insufficient randomness, which made it possible to reconstruct the underlying keys without physical access to the devices and without resorting to social engineering.

According to Weibel, a hardware wallet is only as secure as its firmware, its key generation and the processes behind them. There is no indication that the same weakness exists at other manufacturers, but the researcher warns against treating the episode as marginal.

The immediate effect is psychological. The case may shake confidence in self-custody for a while, without rendering the devices obsolete in principle.

No custody solution is entirely free of risk, and in that respect bitcoin is no different from other asset classes. The soundest strategy, in Weibel's view, combines self-custody, professionally managed custody and several safeguards independent of one another.

His closing warning concerns the future. Tools based on artificial intelligence make searching for vulnerabilities far faster and cheaper, which shifts the advantage towards those looking for flaws rather than those fixing them.