The Coldcard hardware wallet exploit has led to losses of approximately $88.6 million, with ongoing thefts affecting thousands of addresses.
Coldcard Bitcoin Heist Escalates to $88 Million
The ongoing exploitation of Coldcard hardware wallets has resulted in an estimated $88.6 million in losses, affecting 4,585 addresses across three distinct incidents. Galaxy Research reported a recent surge in thefts, indicating that attackers have stolen approximately 1,367 BTC, with the latest incident involving the theft of 207.73 BTC.
Alex Thorn, head of research at Galaxy, noted that the thefts appear to be systematic and possibly facilitated by advanced language models. He cautioned that all single-signature Coldcard addresses created after a firmware vulnerability in March 2021 are at risk of being compromised. Thorn urged users to transfer their funds immediately to avoid potential losses.
In a post on X, Thorn stated, “The attack is ongoing—move your funds off Coldcard-generated addresses immediately if you have not done so.” He has been actively updating a database of victim and attacker addresses, collaborating with federal authorities and cybersecurity experts to address the situation.
The vulnerability originated from a firmware issue on Coinkite devices that led to the generation of insecure seed phrases, making private keys easier to guess. The stolen funds have remained untouched for an average of over three years, suggesting that many victims were long-term holders.
This alarming trend has prompted a shift in user behavior, with many individuals withdrawing their Bitcoin from self-custodial wallets and returning to centralized exchanges like Coinbase and Binance, contrary to the widely held belief that “not your keys, not your coins.” Security experts are advising caution as users navigate this crisis.
Some victims have reported significant losses despite taking precautions. Canadian coach Jonathan Goodman revealed that 18.25 BTC, worth around $1.6 million CAD, was drained from his wallet in minutes, despite his Coldcard device being kept securely in a safety deposit box and never connected to the internet. He expressed frustration at having followed best practices and is now pursuing legal action.
