Coldcard Hack Update: Losses Cross 1,778 $BTC
Galaxy Research confirms the Coldcard wallet exploit drained over 1,778 $BTC (~$112M). Here's where we stand:
1,531 $BTC still unmoved in attacker wallets
~246 $BTC moved, 65% into Coinjoin mixers
3 major waves + 30+ smaller attack footprints tracked
33 attacker addresses shared with exchanges & law enforcement
190+ victims contacted directly
No confirmed attacker activity after Aug 6
A suspected 4th wave of 638.5 $BTC is unconfirmed. If real, total losses hit 2,417 $BTC ($151M+).
The root cause: A March 2021 firmware update switched Coldcard seed generation from hardware RNG to software. Key strength dropped from 128 bits to as low as 40 bits. Attackers could rebuild seeds using just the device serial number and clock state. No phishing. No malware. No physical access required.
The attack pause is NOT an all-clear. If you're holding $BTC on a single-sig Coldcard, move your funds to a fresh seed on a secure device NOW.
Lesson: Self-custody isn't set-and-forget. Verify your firmware. Use multi-sig for large holdings. Treat entropy like a security layer, not a footnote.
Galaxy Research confirms the Coldcard wallet exploit drained over 1,778 $BTC (~$112M). Here's where we stand:
1,531 $BTC still unmoved in attacker wallets
~246 $BTC moved, 65% into Coinjoin mixers
3 major waves + 30+ smaller attack footprints tracked
33 attacker addresses shared with exchanges & law enforcement
190+ victims contacted directly
No confirmed attacker activity after Aug 6
A suspected 4th wave of 638.5 $BTC is unconfirmed. If real, total losses hit 2,417 $BTC ($151M+).
The root cause: A March 2021 firmware update switched Coldcard seed generation from hardware RNG to software. Key strength dropped from 128 bits to as low as 40 bits. Attackers could rebuild seeds using just the device serial number and clock state. No phishing. No malware. No physical access required.
The attack pause is NOT an all-clear. If you're holding $BTC on a single-sig Coldcard, move your funds to a fresh seed on a secure device NOW.
Lesson: Self-custody isn't set-and-forget. Verify your firmware. Use multi-sig for large holdings. Treat entropy like a security layer, not a footnote.