Home›Crypto›Market Structure›Coldcard firmware flaw enables ongoing Bitcoin theft n…

Coldcard firmware flaw enables ongoing Bitcoin theft near $114M

Galaxy Research estimates about 1,367 BTC, or $88.6 million, were stolen across 4,585 addresses in three waves, and it warns the exploit could keep emptying vulnerable devices.

Reported · Written up by our desk · Market Structure

Coldcard, a widely used self-custody Bitcoin hardware wallet, has become the focus of one of the largest thefts targeting offline storage after attackers exploited a firmware flaw to drain wallets without physically accessing the devices, according to Decrypt.

The issue stems from a March 2021 Coldcard update that drew wallet seeds from a weak software fallback rather than the hardware random generator, reducing the security of affected Mk3 devices to roughly 40 bits instead of the intended 128 bits, making the private keys guessable. Decrypt notes the theft is not being attributed to phishing, and coins that reportedly sat untouched for years have been swept from wallets that never connected to the internet.

Galaxy Research, cited by Decrypt, now tracks roughly 1,367 BTC stolen, about $88.6 million, across 4,585 addresses in three distinct waves, with a newest wave flagged on Saturday. The outlet reports Galaxy has warned the exploit is ongoing, that every vulnerable device will eventually be emptied, and it has handed about 600 suspected attacker addresses to federal investigators.

Coinkite, Coldcard’s maker, told Decrypt it must assume an attacker used AI to search its open-source firmware for the flaw, and said its own AI review of the same code in the prior weeks did not find the bug. Decrypt also reports Galaxy’s head of research Alex Thorn said the sweeps appear programmatic and likely orchestrated with a large language model, as the potential damage is nearing $114 million.

Latest closeBitcoin $63,780.28 ▲0.5%

More like this

Sources