Home›Crypto›Market Structure›Coldcard wallets drained of over $70 million without d…

Coldcard wallets drained of over $70 million without device access

Galaxy Research said the attacker swept 1,196 wallets in a 41-minute window on July 30, using reconstructed private keys without touching the hardware.

Reported · Written up by our desk · Market Structure

More than 1,000 bitcoin, worth about $70 million, were drained from 1,196 Coldcard hardware wallets in a 41-minute span on July 30, according to analysis by Galaxy Research cited by CoinDesk.

The research attributes the theft to a Coldcard firmware issue that made seed phrases computationally enumerable, enabling attackers to recreate likely private keys offline without accessing the devices, while the stolen bitcoin was swept across six blocks between 01:10 and 01:51 UTC.

CoinDesk reports that the proceeds were consolidated into four addresses and, at the time of the mapping, had not moved, and that earlier reporting had captured only one address, which helped explain why the total loss nearly doubled as investigators traced additional flows.

Security firms warn additional wallets could be affected because owners cannot reliably determine whether their seed phrases were generated using the vulnerable firmware, even as investigators work to track the attacker using blockchain data provider logs.

Latest closeBitcoin $63,014.95 ▼2.6%

More like this

Sources