Coldcard Exploit Hits $88 Million as Wallets Drain 🚨

Hardware wallets have long been celebrated as the gold standard of cryptocurrency security, anchored by the famous industry adage: "Not your keys, not your coins." However, an escalating security nightmare surrounding Coldcard Bitcoin wallets has shaken that fundamental belief to its core.

According to updated tracking from Galaxy Research, total observed stolen funds have now reached approximately 1,367 BTC—worth roughly $88.6 million—spread across 4,585 compromised wallet addresses. With attackers continuing to systematically drain vulnerable devices, crypto security experts are warning that every single-signature wallet affected by the underlying vulnerability will eventually be emptied unless users act immediately.

The Root Cause: A Flaw in Randomness

The source of this devastating exploit dates back to a March 2021 firmware build error by Coinkite, the manufacturer of Coldcard hardware wallets.

During key generation, a cryptographically secure hardware device relies on high-quality entropy (pure randomness) to generate a seed phrase. The 2021 firmware glitch severely compromised this process, resulting in seed phrases created with vastly insufficient randomness. Because the entropy pool was constrained, the resulting private keys became predictable and computationally guessable by sophisticated threat actors.

For years, millions of pounds in Bitcoin sat undisturbed on these addresses. But once attackers calculated the compromised key spaces, those dormant funds became easy targets.

Inside the Attack: Three Waves and LLM Orchestration

Galaxy Research’s head of research, Alex Thorn, revealed that the thefts have unfolded in three distinct waves. The third and most recent wave alone swept away 207.73 BTC.

Key insights from the ongoing investigation include:

• Long-term HODLers Targeted: The stolen Bitcoin had an average dormancy of 3.18 years prior to being swept. These were not active traders, but long-term investors who believed their assets were completely safe in cold storage.
• Programmatic Execution: The sweeps are highly deliberate and automated. Researchers suspect the attackers may be utilising Large Language Models (LLMs) or custom AI scripts to orchestrate the mass monitoring and draining of compromised addresses.
• Stationary Stashes: Interestingly, the stolen funds across all three waves currently remain parked in the attackers' destination addresses and have not yet been moved through mixers or centralised exchanges.
• Law Enforcement Collaboration: Galaxy Research has catalogued roughly 600 suspected attacker addresses and shared its investigation database with federal investigators, compliance firms, and cybersecurity teams worldwide.

A Devastating Human Toll

The vulnerability has led to tragic financial losses for individual investors who believed they were following every recommended security protocol.

Canadian coach Jonathan Goodman shared his personal ordeal after losing 18.25 BTC (approximately $1.6 million CAD) in a span of just seven minutes. Despite keeping his recovery seed phrases stored safely inside an offline physical safety deposit box that had never touched the internet, his funds were swept remotely due to the predictable nature of his keys.

"Perhaps the hardest part about this is that I did everything right," Goodman noted, describing the helplessness experienced by victims of hardware-level cryptographic failures.

The Ethos Inversion: Panic Moving to Centralised Exchanges

This disaster has sparked an unprecedented reversal in user behaviour across the crypto community. In a stark inversion of the self-custody movement, panicked holders are rushing to transfer their Bitcoin off single-signature hardware wallets and back onto centralised exchanges like Coinbase and Binance, or onto newly generated, verified secure devices.

For many, temporary custodian holding on an exchange has suddenly felt safer than managing a hardware wallet generated during the flawed firmware window.

Crucial Steps for Coldcard Users

If you generated a single-signature Bitcoin wallet on a Coldcard device using firmware updated around or after March 2021, take the following steps immediately:

1. Do Not Trust the Existing Seed Phrase: Simply updating your device's firmware will not make an existing seed phrase secure. If the original seed was generated with weak entropy, the private keys remain permanently compromised.
2. Move Funds Instantly: Transfer all Bitcoin out of single-sig Coldcard addresses created during the vulnerable period. Move them to a clean, newly generated wallet (created on an uncompromised device) or a secure multisig setup.
3. Consider Multisig Setups: Multisignature (multisig) vaults require multiple independent keys to authorise a transaction, ensuring that even if one key is compromised, the overall vault remains secure.

For More Information:

To read the original reporting and stay updated on further developments regarding this exploit, visit the source article on Decrypt:

👉 Coldcard Bitcoin Exploit Balloons to $88 Million as Attackers Keep Draining Wallets

Disclaimer: This article is provided for informational purposes only, mistakes may be made, and it's not offered or intended to be used as legal, tax, investment, financial, or any other advice.