Bitcoin Cold-Wallet Attack Affects 4,500 Addresses, Losses Reach $89 Million

Galaxy Research Reports on Ongoing Exploits of Coldcard Vulnerabilities

A significant cold-wallet attack has affected approximately 4,585 bitcoin addresses, leading to total losses of about 1,367 bitcoin, valued at nearly $89 million. The attacks have been traced back to a flaw in a Coldcard firmware update from March 2021, which allowed hackers to replicate keys generated with insufficient randomness.

The latest wave of attacks, identified by Galaxy Research, focuses on wallets containing smaller amounts of bitcoin. Over a recent two-day period, around 208 bitcoin were siphoned from 1,912 addresses, averaging just over 0.1 bitcoin per victim. This contrasts sharply with the initial wave on July 30, which drained nearly 1,083 bitcoin from 1,196 addresses in a mere 41 minutes.

These attacks have evolved, with the latest wave employing more sophisticated transaction methods, making it harder to trace the stolen funds. Unlike previous waves that pooled stolen coins into a few addresses, this time each victim’s bitcoin is sent to individual destinations. The attackers are now using pay-to-witness-script-hash outputs that can incorporate multisignature or timelock conditions, as opposed to the simpler outputs used in earlier attacks.

Despite the decline in the average haul per attack, the sweeping appears to continue, suggesting that the most profitable keys have already been exploited. Galaxy Research believes that these attacks could be orchestrated by a single operator, although they remain cautious about confirming whether all three waves are executed by the same individual due to the lack of clarity on the blockchain.

The root vulnerability lies in the firmware's reliance on a predictable software randomizer for seed generation, which allows for the offline reproduction of a limited set of keys by anyone with the necessary knowledge. As the attacks persist, the crypto community is urged to remain vigilant against potential future threats.