External ReportingVeröffentlicht vor 20 Stunden

Losses Top $115M In Coldcard Bitcoin Hack: Galaxy Research

New data from Galaxy Research shows that $115 million in bitcoin has been lost in the Coldcard theft.

Von Mathew Di SalvoPublisher Bitcoin Magazine 1 Min. Lesezeit

Image via Bitcoin Magazine

$115MBitcoin reported lost

200+Victims contacted by Galaxy

15+Separate attackers exploiting bug

4.0.1Affected firmware version begins

Why This Matters

The losses and the weak seed-generation flaw represent a material hardware-wallet security incident, potentially affecting users of Coldcard Mk3 firmware across several years and enabling multiple independent attackers. It could undermine confidence in self-custody hardware, while the movement of funds to exchanges may increase custody and market-structure risks for affected Bitcoin holders.

Security Context

Affected ecosystemBitcoin hardware wallet security

Affected providersCoinkite · Coldcard · Galaxy Research

MitigationUsers urged to update or move funds

Market Context

Bitcoin

BTC

$64,624

+0.40% 24h

Layer Index

Neutral

Layer Index

↑ 6 pts in 24h

New data from Galaxy Research shows that $115 million in bitcoin has been lost in the Coldcard theft.

Writing on X Sunday, Galaxy Research said that it had spoken with over 200 victims to support them and gather intelligence on the attackers.

The figures are based on the price of bitcoin at the time of the attack.

Hackers started taking bitcoin stored using Coinkite’s popular Coldcard hardware wallet on July 31.

Canadian company Coinkite said that a firmware bug in Coldcard Mk3 devices — starting with version 4.0.1 in March 2021 — caused seed generation to fall back to a weak software Pseudorandom Number Generator instead of the hardware true random number generator, allowing hackers to essentially guess investor seedphrases.

The number has slowly risen as the criminals have targeted more recent devices while Coinkite and other Bitcoiners have urged Coldcard users to immediately move their funds.

Galaxy Research last week said that it estimates at least 15 separate attackers were exploiting the bug independently.

Previous research from Galaxy found that the typical stolen coin had sat untouched for 3.5 years, and a striking 88% of pilfered funds were at least a year old.

The firm is still confirming how much is stolen, and has said that total losses could exceed $130 million.

Since the attack, cautious investors have been moving their coins to other storage solutions — including exchanges.

Coinkite said in a statement this week that the bug in its software “silently went unnoticed” and “its potential impact grew with every release” of its products.

Days after the first hack, the company urged investors to update their software or move their funds off the popular hardware wallet.

Enjoyed this story?

Follow Mathew Di Salvo and get alerted the moment their next story goes live.

Follow the Story