Bitcoin Holders Lose $88,600,000 in Coldcard Crypto Wallet Exploit: Galaxy Researchers

Crypto researchers say Bitcoin investors have now lost more than $88 million to an exploit in the Coldcard hardware wallet.

Researchers at Galaxy say BTC is being drained from addresses by bad actors in waves, due to a firmware bug that dramatically reduced the randomness of how the wallet creates its secret recovery phrase.

“A 3rd wave in what we suspect are hacks of Coldcard-generated addresses has been identified in which 207.7294 BTC has been drained. Our estimated observed size of the Coldcard hack is now 1,367.05 BTC (~$88.6m) across 4,585 addresses…

Waves 1 and 2 followed similar patterns: the same funnel topology into a handful of shared collectors, the same P2WPKH destinations, the same mix of derivation paths, 27 hours apart. Treating them as one operator is reasonable, but it rests on resemblance, not on proof, and they already differ in two respects — the fee constant, and whether the sweeps signal replace-by-fee.

Even if we can assume Waves 1 and 2 are the same attacker, Wave 3 should not be assumed to be the same operator. It differs from both earlier waves on every behavioural axis we can measure: it abandons the shared collector for one destination per victim, it holds in P2WSH rather than P2WPKH, it batches an average of 6.37 victims into each sweep where wave 1 took exactly one, and it scans only the default derivation path.

… Continue reading the full article at the original source below.