Galaxy Digital: Coldcard Losses Blow Past $100M After 1,596 BTC Stolen Across 17 Attack Waves
TL;DR
- Galaxy Research identified 1,596 BTC stolen from 7,300 addresses across three confirmed waves linked to a vulnerability in Coldcard.
- An unconfirmed fourth wave would bring the total to 2,055 BTC, equivalent to approximately $130 million in losses.
- 90% of the stolen funds have not moved, and Galaxy is collaborating with U.S. federal agencies to track the compromised addresses.
A hardware vulnerability in Coldcard could have resulted in losses of up to $130 million in bitcoin, according to an analysis published Monday by Galaxy Research.
The firm identified 1,596 BTC stolen from 7,300 addresses across three confirmed waves of attacks, plus 14 incidents of smaller scale. The root of the problem lies in a flaw affecting seeds generated on the Mk3, Mk4 and Mk5 models of Coinkite, as well as certain firmware versions of the Coldcard Q.
The first exploit reports emerged on July 30 in what appeared to be a programmatic and automated sweep, possibly assisted by large language models. Coinkite responded with emergency firmware updates for all affected models and confirmed that it destroyed the remaining vulnerable inventory.
… Continue reading the full article at the original source below.
