Binance Founder Warns on Hardware Wallet Security Following $70 Million Coldcard Exploit

Binance founder Changpeng Zhao has issued a warning to cryptocurrency holders regarding the security of hardware wallets. This follows an exploit that resulted in the theft of millions in Bitcoin from Coldcard devices. Zhao stated that even established hardware wallets could contain vulnerabilities and that no security setup is entirely invulnerable.

The warning from Zhao came after a flaw was identified in Coldcard devices manufactured by Coinkite. A build error, originating from firmware released in March 2021, caused the seeds on affected units to be generated from a software fallback mechanism instead of the intended hardware random-number generator. This made the private keys significantly easier to compromise. Updating the firmware does not rectify seeds created on devices already affected by this vulnerability.

Coinkite has released emergency hotfixes and recommended that affected users migrate their funds to newly generated seeds.

Initial estimates of the theft have been significantly revised upwards. Earlier reports indicated losses of approximately 594 BTC, valued at around $38 million, from about 500 wallets. However, a report from Galaxy Research now places the total loss at approximately 1,082.65 BTC, equivalent to about $70.2 million. This amount was drained from 1,196 addresses within a 41-minute period on July 30.

Galaxy Research noted that each transaction involved an identical, hardcoded fee and did not include any change output. This suggests the use of an automated tool spending pre-existing keys rather than owners initiating their own fund transfers. The affected addresses included both native SegWit and older address types, indicating a multi-path key scanning approach. The stolen Bitcoin was rapidly consolidated into a few addresses and has not been moved since.