Coldcard Bitcoin Losses May Reach $114 Million as Fourth Sweep Emerges
A possible fourth wave of attacks targeting Bitcoin addresses generated by Coldcard wallets has raised estimated losses to about 1,816 BTC, worth roughly $114 million, across more than 5,200 addresses since July 30.
Galaxy Research’s Alex Thorn said the latest transactions enabled replace-by-fee, meaning victims who identify their address in Bitcoin’s mempool may still be able to move their funds first by submitting a competing transaction with a higher fee.
The exploit has been linked to Coldcard firmware released in March 2021, which allegedly used a predictable software-based randomizer for seed generation instead of the wallet’s hardware random-number generator. This may allow attackers to reproduce affected private keys offline.
Coldcard manufacturer Coinkite has released emergency firmware and advised users who created seeds using affected software to immediately transfer their Bitcoin to fresh addresses generated with new seeds.
The first attack wave reportedly stole 1,083 BTC from 1,196 addresses in just 41 minutes. Three additional waves may have increased the total to 1,816 BTC. Researchers said multisignature wallets have not been affected, suggesting the vulnerability is limited to single-key seeds.
$BTC
A possible fourth wave of attacks targeting Bitcoin addresses generated by Coldcard wallets has raised estimated losses to about 1,816 BTC, worth roughly $114 million, across more than 5,200 addresses since July 30.
Galaxy Research’s Alex Thorn said the latest transactions enabled replace-by-fee, meaning victims who identify their address in Bitcoin’s mempool may still be able to move their funds first by submitting a competing transaction with a higher fee.
The exploit has been linked to Coldcard firmware released in March 2021, which allegedly used a predictable software-based randomizer for seed generation instead of the wallet’s hardware random-number generator. This may allow attackers to reproduce affected private keys offline.
Coldcard manufacturer Coinkite has released emergency firmware and advised users who created seeds using affected software to immediately transfer their Bitcoin to fresh addresses generated with new seeds.
The first attack wave reportedly stole 1,083 BTC from 1,196 addresses in just 41 minutes. Three additional waves may have increased the total to 1,816 BTC. Researchers said multisignature wallets have not been affected, suggesting the vulnerability is limited to single-key seeds.
$BTC