TORONTO — Hackers have stolen roughly $140 million Canadian in Bitcoin from thousands of accounts after exploiting a software flaw in hardware wallets made by Toronto-based Coinkite Inc.Galaxy Research estimates 1,596 Bitcoin have been drained from roughly 7,300 addresses across multiple attack waves that began in late July, with a possible fourth wave that could push total losses toward $180 million.The Canadian company, which produces Coldcard devices designed for offline “cold” storage of cryptocurrency, notified users late last week that some wallets had been compromised. Cold wallets are intended to be among the most secure ways to hold Bitcoin because the private keys never touch the internet.However, a flaw dating to a March 2021 firmware update caused affected devices to generate seed phrases using a weak software random-number generator instead of the hardware one. This reduced the effective randomness dramatically — to about 40 bits on older Mk2 and Mk3 models and roughly 72 bits on later models — allowing attackers to recalculate the keys remotely and empty the wallets without physical access..Many victims reported following standard security practices, including keeping devices offline and storing them in safety deposit boxes. One Canadian said he lost about $1.6 million after three of his wallets were drained in seven minutes.Coinkite has released emergency firmware updates for all affected models and destroyed remaining vulnerable inventory. The company has also said it believes an attacker may have used artificial intelligence to discover the flaw in its open-source code. Updating the firmware does not repair existing seed phrases; users must generate entirely new seeds on fixed software and move their funds.Chainalysis analysis has indicated that Canadian Bitcoin holders have borne a disproportionate share of the losses. The attack remains ongoing, according to on-chain researchers.
