Key Takeaways
- • Galaxy Research has identified a third wave of thefts from Coldcard hardware wallets, bringing total observed losses to approximately $88.6 million (1,367 BTC) across 4,585 compromised addresses, with the exploit still ongoing.
- • The vulnerability stems from a March 2021 firmware build error in Coinkite's Coldcard devices that generated seed phrases with insufficient randomness, making private keys guessable by attackers using algorithmic methods.
- • Galaxy Research has flagged roughly 600 suspected attacker addresses to federal investigators and compliance firms; stolen funds remain parked in attacker addresses and have not moved, suggesting deliberate, programmatic sweeps likely orchestrated with large language models.
- • Victims held an average of 3.18 years of dormancy before funds were stolen, indicating long-term holders were targeted; Galaxy warns that every single-signature Coldcard address created after the 2021 firmware update will eventually be drained.
- • Coinkite has urged customers to immediately generate new recovery phrases and move funds from Coldcard-generated addresses, as the attack targets progressively smaller balances across affected wallets.
Summary
The ongoing exploitation of Coldcard hardware wallets has reached $88.6 million in confirmed Bitcoin theft, according to Galaxy Research's latest tracking released Saturday. The firm identified a third wave of attacks that drained an additional 207.73 BTC, bringing the cumulative total to approximately 1,367 BTC across 4,585 compromised addresses. Galaxy Research emphasized that the exploit remains active and warned that every vulnerable device will eventually be emptied, urging holders of single-signature funds on Coldcard devices to move their assets immediately.
The root cause traces back to a March 2021 firmware build error on Coinkite's Coldcard devices, which generated seed phrases with far too little randomness. This flaw rendered private keys guessable by attackers employing programmatic and algorithmic methods. Alex Thorn, Galaxy Research's head of research, noted that the sweeps appear deliberate and orchestrated, likely using large language models to identify and target vulnerable addresses systematically. The firm has flagged approximately 600 suspected attacker addresses to federal investigators, compliance firms, and cross-industry cyber investigators, working with victim transaction data to map on-chain patterns.
A notable characteristic of the thefts is the extended dormancy period before funds were stolen. Thorn noted that stolen coins had sat untouched for an average of 3.18 years before being drained, underscoring that victims were predominantly long-term Bitcoin holders. The stolen funds recovered in all three documented waves remain parked in attacker addresses and have not been moved, suggesting either accumulation strategy or preparation for later liquidation. Galaxy warned that the attack will continue targeting every single-signature Coldcard address created after the 2021 firmware update, making it a matter of time until remaining vulnerable wallets are compromised. Coinkite has advised customers to generate new recovery phrases and relocate funds from affected Coldcard addresses as an immediate mitigation measure.
The root cause traces back to a March 2021 firmware build error on Coinkite's Coldcard devices, which generated seed phrases with far too little randomness. This flaw rendered private keys guessable by attackers employing programmatic and algorithmic methods. Alex Thorn, Galaxy Research's head of research, noted that the sweeps appear deliberate and orchestrated, likely using large language models to identify and target vulnerable addresses systematically. The firm has flagged approximately 600 suspected attacker addresses to federal investigators, compliance firms, and cross-industry cyber investigators, working with victim transaction data to map on-chain patterns.
A notable characteristic of the thefts is the extended dormancy period before funds were stolen. Thorn noted that stolen coins had sat untouched for an average of 3.18 years before being drained, underscoring that victims were predominantly long-term Bitcoin holders. The stolen funds recovered in all three documented waves remain parked in attacker addresses and have not been moved, suggesting either accumulation strategy or preparation for later liquidation. Galaxy warned that the attack will continue targeting every single-signature Coldcard address created after the 2021 firmware update, making it a matter of time until remaining vulnerable wallets are compromised. Coinkite has advised customers to generate new recovery phrases and relocate funds from affected Coldcard addresses as an immediate mitigation measure.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.