Accounts Drained Even Without Internet Connection, Rp 1.59 Trillion Vanish
A wave of cyber attacks targeting users of the Coldcard hardware crypto wallet has sparked fresh concerns in the digital asset industry. In the incident, crypto assets worth US$88.6 million, or approximately Rp1.59 trillion (at an exchange rate of Rp18,000 per US dollar), were reported stolen.
Coinkite Inc. CEO Rodolfo Novak acknowledged that developments in artificial intelligence (AI) have presented new challenges for software security. The statement was made following the crypto theft incident, which triggered warnings that AI is now reshaping cyber threat patterns with increasingly sophisticated capabilities to detect software vulnerabilities.
“We believe this is the bitter reality of the new AI paradigm,” Novak said in his apology to users. According to him, AI-assisted code review processes are now able to find hidden bugs much faster than the capabilities of experienced cyber security experts.
Coldcard has long been known as a hardware wallet that relies on cold storage methods, meaning users’ private keys are stored offline and are considered more secure than storing assets on crypto exchanges. However, in this case, the perpetrators did not hack the device directly but instead exploited a weakness in the random number algorithm, enabling them to discover users’ keys and drain their funds.
Novak stressed that any firmware that is open-source or has ever been published must be assumed to have been studied both by parties seeking to strengthen security and by cyber criminals. Consequently, Coinkite is asking all users to immediately update the firmware released in March 2021 and to move their Bitcoin to new wallets using new seed phrases or recovery phrases.
Digital finance platform Galaxy revealed it had identified three waves of attacks against Coldcard users up to last week. The total assets stolen reached 1,367.05 BTC, worth approximately US$88.6 million or Rp1.59 trillion. A day later, Galaxy warned of the possibility of a fourth wave of attacks that could increase the total losses to 2,055 BTC, equivalent to around US$130 million or Rp2.34 trillion.
The incident serves as a reminder that hardware wallets are not entirely risk-free, even though they have long been considered the safest method of storing crypto assets. Vulnerabilities in software can still be exploited by perpetrators to access user funds without having to physically attack the device.
Meanwhile, a number of industry observers believe that the transparency of blockchain transactions still provides an opportunity to trace the movement of stolen assets. One observer even suggested that the perpetrator return the funds and accept a bug bounty reward through negotiation with Coinkite, a solution deemed more profitable than attempting to liquidate the stolen assets.