Home›Crypto›Market Structure›Coldcard attackers could near $114 million in a new Bi…

Coldcard attackers could near $114 million in a new Bitcoin sweep

Researchers estimate the latest wave has moved about 1,816 bitcoin since July 30, and the replace-by-fee design means victims may be able to outbid the attacker before confirmation.

Reported · Written up by our desk · Market Structure

A fresh wave of Bitcoin sweeps targeting Coldcard-generated addresses has been underway since early Monday, with researchers estimating the attacker has moved about 1,816 bitcoin, roughly $114 million, from more than 5,200 addresses since July 30, according to CoinDesk. Unlike earlier sweeps, the new transactions appear to use Bitcoin’s replace-by-fee mechanism. That feature allows a pending transaction to be overwritten by a later transaction with a higher fee, so anyone who detects their funds in the mempool can potentially pay more and move coins before the attacker’s transaction confirms. CoinDesk reports researchers say the attack pattern points to a flaw affecting single-key Coldcard seeds rather than multisignature setups. The attacker has also been sending to previously unused addresses, which are described as harder to trace than in earlier waves.

The issue traces back to a predictable software randomizer tied to a March 2021 firmware build, which routed seed generation away from the chip’s hardware randomization. CoinDesk adds that Coldcard, via Coinkite, released emergency firmware for affected models and advised users who generated seeds with the flawed software to move funds to addresses created with a fresh seed, while Galaxy Research head Alex Thorn flagged the active wave based on pattern matching without direct victim reports.

Latest closeBitcoin $62,614.96 ▼1.4%

More like this

Sources