Coldcard Bitcoin exploit drains $89 million as fourth wave hits wallets

Attackers have drained roughly 1,367 Bitcoin, worth about $89 million, from Coldcard-generated wallets across four waves since late July.

About 1,367 Bitcoin, worth roughly $89 million, has been drained from Coldcard-generated wallets across four attack waves, with a fourth sweep taking 388.93 BTC from 462 addresses in 218 transactions, according to Galaxy Research.

"The attack is ongoing — move your funds off Coldcard-generated addresses immediately if you have not done so," Alex Thorn, head of research at Galaxy, said on X.

The fourth wave, reported late Sunday, followed a third sweep that took 207.73 BTC from 1,912 addresses between Friday midday and Saturday morning UTC. The first wave, launched July 30, stole 1,083 BTC from 1,196 addresses in 41 minutes. Galaxy has flagged roughly 600 suspected attacker addresses to federal investigators, compliance firms and cross-industry cyber investigators.

The flaw stems from a March 2021 Coldcard firmware release that relied on a predictable software random number generator during seed generation, creating a limited pool of private keys attackers can reproduce offline without physical access to the device. Thorn warned every single-signature Coldcard address created after that update will eventually be drained.

Fourth wave shifts on-chain strategy

The latest campaign uses a different on-chain approach than earlier sweeps. Instead of sending stolen funds to a small group of collection wallets, each victim's Bitcoin is transferred to a unique destination address, stored in pay-to-witness-script-hash outputs that support multisignature wallets and timelocks. The attacker also grouped an average of six victims into each transaction and scanned only the default derivation path.

The stolen coins had sat untouched for years before being taken — an average dormancy of 3.18 years — showing that victims were long-term holders. Funds from the documented waves remain parked in attacker addresses and have not moved.

Self-custody debate reignites

The incident has become a broader test for Bitcoin self-custody. Small transfers below 1 BTC climbed to 39,600 BTC on Friday, the highest daily level since November 2022, according to CryptoQuant head of research Julio Moreno. "The Bitcoin plebs had not moved this amount of BTC in a day since the FTX collapse," Moreno said.

Nick Neuman, chief executive of Bitcoin security firm Casa, pushed back against claims that self-custody is over, estimating that potentially 10 times more Bitcoin was protected through self-custody than was stolen. Binance co-founder Changpeng Zhao said bug fixes cannot retroactively secure previously generated wallets. "I'm a believer in self-custody, but it puts the burden on you," he said.

Coldcard confirmed the vulnerability and said it has halted shipments and destroyed all remaining units with the affected firmware installed at its facilities. Bitcoin traded at $63,251, down 0.81 percent in 24 hours, as of 14:30 UTC.

This article is for informational purposes only and does not constitute investment advice.