Disclaimer: The opinions expressed by our writers are their own and do not represent the views of U.Today. The financial and market information provided on U.Today is intended for informational purposes only. U.Today is not liable for any financial losses incurred while trading cryptocurrencies. Conduct your own research by contacting financial experts before making any investment decisions. We believe that all content is accurate as of the date of publication, but certain offers mentioned may no longer be available.
Vocal Dogecoin community member Mishaboar issued an important alert to crypto holders in a recent X post. This comes in the wake of a major security breach of Coldcard, a popular Bitcoin-only hardware wallet, with urgent safety steps now necessitated.
This advisory was directed to anyone who has ever used a Coldcard device of any kind, with Mishaboar urging them to migrate their funds to a new wallet immediately. Also, an important point raised by Mishaboar is that users should never reuse the Coldcard seed phrase but rather create a new one on the new wallet.
This warning comes in the wake of an urgent alert by Coldcard to its users to upgrade their devices, generate a new seed, and carefully move their funds away from the wallet.
In a separate post, Mishaboar shared an important precaution for hardware wallet users, urging them to never enter their seed phrase into a computer, adding that offline backups must be kept in a safe place, with at least one copy in a different location.
Coldcard vulnerability
A vulnerability in a March 2021 Coldcard firmware release allowed attackers to systematically drain bitcoin from thousands of wallets by reproducing keys generated with weak software-based randomness.
Galaxy Research said its Bitcoin on-chain analysis identified three suspected attack waves targeting addresses generated by Coldcard, involving 4,585 addresses and a total of 1,367.05 BTC worth about $88.6 million.
Alex Thorn, Galaxy Research's head of research, stated that attacks linked to the Coldcard vulnerability are ongoing and urged affected users who have not yet migrated their assets to move their funds as soon as possible. He said the Bitcoin stolen in the three identified large-scale attack waves remains in attacker-controlled addresses and has not been moved.
The stolen BTC had been dormant for an average of 3.18 years before the incident, with a median of 3.55 years, indicating that most victims were long-term holders.
Dan Burgin
