Cointelegraph2 hours agoCrime1 min read

New Wave of Thefts Targets Coldcard Bitcoin Wallets, Moving 388.9 BTC

Quick Look

Coldcard Bitcoin hardware wallet users are facing a new wave of coordinated thefts, with Galaxy research head Alex Thorn reporting 218 transactions impacting 462 addresses and moving 388.9 BTC.
This follows the disclosure of a firmware flaw causing less entropy in wallet seeds, leading to an estimated $90 million in Bitcoin stolen from over 1,100 wallets.

AI-generated summary

Why It Matters

This new wave of attacks follows the disclosure of a previously undetected Coldcard firmware flaw that caused affected devices to generate wallet seeds with less entropy than intended. Earlier estimates suggested over 1,100 wallets were impacted, with $90 million in Bitcoin stolen.

Font size

Coldcard users are being warned of a new wave of coordinated thefts targeting their Bitcoin hardware wallets, coming just days after the first wave of attacks on Thursday.

In an X post on Monday, Galaxy research head Alex Thorn flagged 218 transactions impacting 462 potential victim addresses in the last few hours, moving around 388.9 Bitcoin (BTC).

Thorn said the activity averaged 13.8 sweeps per block, around 45 times the rate observed in a pre-incident control window. Most transfers have seen a fresh destination created for each victim rather than converging on a central collection wallet.

Some funds have already been swept into second hop addresses, he said.

“These are LIKELY Coldcard victims — they match the shape of coldcard vulnerable utxos and the elevated transaction pattern gives me high confidence they are another wave of attacks,” said Thorn.

The researcher said there are similar transactions in the mempool waiting to be confirmed. Affected users who control the relevant keys may be able to broadcast a conflicting transaction with a higher fee to move their funds to a secure wallet before the attacker’s transaction is confirmed.

The activity follows the disclosure of a previously undetected Coldcard firmware flaw that has caused affected devices to generate wallet seeds with less entropy than intended. The latest estimates suggest over 1,100 wallets have been impacted, with $90 million in Bitcoin stolen.