Galaxy Digital Says $70,000,000 Drained From Bitcoin Holders in Coldcard Wallet Exploit
Researchers at Galaxy Digital say about $70 million has been stolen due to an exploit in the popular Bitcoin wallet Coldcard.
The attack was enabled by a firmware bug that dramatically reduced the randomness of how the wallet creates its secret recovery phrase.
According to Galaxy, the vast majority of the funds were stolen in less than an hour.
“While new attacks are likely to occur if users do not migrate their funds out of affected Coldcard-generated addresses, the initial attack is identifiable onchain. Note that this analysis may not be complete, but it represents our best-efforts attempt at scoping the initial impact…
The full event spans six blocks and 41 minutes. Three intervening blocks contain no sweep activity at all, suggesting the transactions were broadcast in batches rather than streamed…
The loss profile is dominated by sub-1 BTC addresses in count, but by 1-50 BTC addresses in value. This is the shape of individual self-custody, not institutional or exchange holdings.”
Coinkite, the company behind Coldcard, says it takes full accountability for the firmware bug and has apologized to affected users.
… Continue reading the full article at the original source below.
