![\"bitcoins](\"https:\/\/smartcdn.gprod.postmedia.digital\/nationalpost\/wp-content\/uploads\/2026\/08\/canadian-debt_303382621.jpeg?quality=90&strip=all&w=288&h=216&sig=fihUNysGp5GpqPYb0LF2dw\")
<\/picture>Article content<\/p>\n
Hackers have absconded with more than US$100 million ($140 million CAD) worth of Bitcoin from thousands of supposedly secure accounts in recent days, setting up another scandal for investors who have been repeatedly preyed upon by thieves in the sector.<\/p>\n<\/section>\n THIS CONTENT IS RESERVED FOR SUBSCRIBERS<\/p>\n Enjoy the latest local, national and international news.<\/p>\n SUBSCRIBE FOR MORE ARTICLES<\/p>\n Enjoy the latest local, national and international news.<\/p>\n REGISTER \/ SIGN IN TO UNLOCK MORE ARTICLES<\/p>\n Create an account or sign in to continue with your reading experience.<\/p>\n THIS ARTICLE IS FREE TO READ REGISTER TO UNLOCK.<\/p>\n Create an account or sign in to continue with your reading experience.<\/p>\n <\/span>or<\/span><\/span><\/p>\n<\/div>\n<\/section>\n Article content<\/p>\n The latest missing money stems from a software flaw in what\u2019s known as a \u201ccold\u201d Bitcoin wallet hosted by Canada-based Coinkite Inc. Cold wallets have physical hardware associated with them alongside private passwords, or \u201ckeys,\u201d intended to add an extra layer of security beyond the typical lengthy codes that nonetheless frequently get hacked.<\/p>\n<\/section>\n Article content<\/p>\n<\/section>\n Article content<\/p>\n<\/section>\n Article content<\/p>\n Yet, Coinkite notified users late last week that some wallets using its Coldcard devices had been compromised. By Monday, more than 1,755 tokens worth around US$110 million had been drained from 5,000 wallets, according to Galaxy Research.<\/p>\n<\/section>\n Article content<\/p>\n By signing up you consent to receive the above newsletter from Postmedia Network Inc.<\/p>\n<\/div>\n<\/section>\n Article content<\/p>\n The breach led to an understandable level of hysteria on social media, not to mention those whose Bitcoin was suddenly, inexplicably gone.<\/p>\n<\/section>\n Article content<\/p>\n \u201cThe moment it loaded I knew I was screwed because I saw red lines for withdrawals,\u201d Jonathan Goodman, one of the victims, told Bloomberg News. \u201cBetween 9:36 and 9:43 p.m. on July 29th, all three of my wallets were completely drained.\u201d<\/p>\n<\/section>\n Article content<\/p>\n Goldman says he lost US$1.6 million due to the attack.<\/p>\n<\/section>\n Article content<\/p>\n Here is how the hack happened, according to cryptocurrency experts and Coinkite itself.<\/p>\n<\/section>\n Article content<\/p>\n A flaw in the software of the Coldcard devices meant that the generated \u201cseed phrase\u201d \u2014 a long string of words used to gain access to a wallet \u2014 was predictable, according to a report from Block Inc.\u2019s engineering team.<\/p>\n<\/section>\n Article content<\/p>\n The core of the issue was how Coinkite implemented the random-number generator when producing the phrases, according to Block. True randomness is a critical component of cryptographic security, but Coldcard wallets had a fallback mechanism that resulted in keys being generated using simpler values, such as the device serial numbers.<\/p>\n<\/section>\n Article content<\/p>\n<\/section>\n Article content<\/p>\n The result was that attackers have been able to systematically recalculate and drain user wallets. Reports on Friday placed losses at around US$38 million, but the figures quickly climbed over the weekend into Monday.<\/p>\n<\/section>\n Article content<\/p>\n \u201cIt\u2019s a reminder that self-custody is only as strong as the processes used to generate and protect private keys,\u201d said Ayesha Kiani, chief operating officer at digital-asset investment firm Monarq Asset Management.<\/p>\n<\/section>\n Article content<\/p>\n In a statement on its website, Coinkite confirmed that funds were still at risk. The company offered a new version of special software for customers, after some had gotten locked out of their devices.<\/p>\n<\/section>\n Article content<\/p>\n The attack has drawn widespread attention online, with influencers to company executives weighing in on the implications.<\/p>\n<\/section>\n Article content<\/p>\n \u201cIt exposes the fallacy of your crypto being offline,\u201d said Aneirin Flynn, chief executive officer of cybersecurity technology firm Failsafe. \u201cThe device is just responsible for generating your passwords, and if the underlying math is broken then your passwords can be reverse-engineered.\u201d<\/p>\n<\/section>\n Article content<\/p>\n For 2026 so far, the amount of crypto stolen is down from last year. The first half of the year has seen total losses reach US$972 million, less than half of the US$2.3 billion stolen during the first half of 2025, according to a TRM Labs report published last month. Still, the total number of hacks climbed to 207, the highest recorded in any six-month period.<\/p>\n<\/section>\n<\/div>\n![\"bitcoins](\"https:\/\/dcs-static.gprod.postmedia.digital\/21.8.0\/websites\/images\/identity\/logo-identity-np-new.svg\" "\\"bitcoins\\""){kind=logo}
<\/p>\n\n
\n
\n
\n
Bitcoins Sign In or Create an Account<\/h2>\n