Crypto hackers drain millions from over 1K bitcoin wallets in string recent attacks linked to software flaw

Owners of a popular bitcoin storage device are being urged to protect their cryptocurrency after security researchers said a software flaw may have allowed attackers to steal roughly $70 million worth of bitcoin in less than an hour.Forbes first reported the attacks, which researchers at Galaxy Research say drained more than 1,000 bitcoin from 1,196 digital wallets in just 41 minutes on July 30.Galaxy later identified two additional suspected waves of suspicious activity, bringing the estimated losses to nearly $89 million.The firm cautioned that its findings are based on blockchain analysis and that it has not confirmed every affected wallet was created using the vulnerable software.The issue involves Coldcard, a handheld device many cryptocurrency investors use to store bitcoin offline instead of leaving it on a cryptocurrency exchange.Often called a “hardware wallet,” the device is designed to keep hackers from accessing a user’s bitcoin over the internet.According to a security advisory from Block’s Bitcoin Engineering and Security team, a coding mistake in certain versions of Coldcard may have weakened one of the wallet’s key security features.Block said the software bug may have made some of those recovery phrases predictable enough for sophisticated attackers to figure them out under certain circumstances, potentially allowing them to steal bitcoin without ever physically touching the wallet.The company said it released its findings because it believes the attacks are still happening, though researchers cautioned they are continuing to study exactly how the vulnerability is being exploited.Canadian company Coinkite, which makes Coldcard, has since released a software update to prevent the problem from affecting newly created wallets.However, the company warned that simply installing the update will not protect people who already created a recovery phrase using the affected software.Instead, Coinkite is urging those users to create a brand-ne...