Bitcoin · CoinDesk
How a bug in Coldcard’s code went unnoticed for years, leading to $100 million in hacked funds
Compiled by KHAO Editorial — aggregated from 1 source. See llms.txt for citation guidance.
★ Tier-1 Source
Jonathan Goodman followed the rules for keeping his bitcoin safe.
Key facts
- Combined CEX volumes fell 23.9% to $3.76T in July, the lowest since November 2023, as DEX spot market share climbed to a record 19.5% and RWA perps hit $460B
- Galaxy Research said it had high confidence that 1,596 bitcoin — worth over $100 million, had been stolen from about 7,300 addresses in a series of attacks
- The Toronto entrepreneur reported losing 18.25 bitcoin, worth over $1.17 million at the time of the attack
- Coinkite described firmware version 4.0.0 as " All New Code, Same Great Features
Summary
The hardware wallet holding his keys, a Coldcard, had never been connected to the internet. The Toronto entrepreneur reported losing 18.25 bitcoin, worth over $1.17 million at the time of the attack. “Perhaps the hardest part about this is that I did everything right,” he wrote in an Aug 1 X post. Goodman’s loss was part of a much larger hack impacting thousands of Coldcard users. A hardware wallet’s entire security premise is that its secrets never leave the chip. Hardware wallets, or “cold wallets,” such as Coldcard keep the keys on a separate device that’s not connected to the internet.