Losses Top $115M In Coldcard Bitcoin Hack: Galaxy Research

New data from Galaxy Research shows that $115 million in bitcoin has been lost in the Coldcard theft. 

Writing on X Sunday, Galaxy Research said that it had spoken with over 200 victims to support them and gather intelligence on the attackers. 

The figures are based on the price of bitcoin at the time of the attack. 

Hackers started taking bitcoin stored using Coinkite’s popular Coldcard hardware wallet on July 31. 

Canadian company Coinkite said that a firmware bug in Coldcard Mk3 devices — starting with version 4.0.1 in March 2021 — caused seed generation to fall back to a weak software Pseudorandom Number Generator instead of the hardware true random number generator, allowing hackers to essentially guess investor seedphrases. 

The number has slowly risen as the criminals have targeted more recent devices while Coinkite and other Bitcoiners have urged Coldcard users to immediately move their funds. 

Galaxy Research last week said that it estimates at least 15 separate attackers were exploiting the bug independently. 

Previous research from Galaxy found that the typical stolen coin had sat untouched for 3.5 years, and a striking 88% of pilfered funds were at least a year old. 

The firm is still confirming how much is stolen, and has said that total losses could exceed $130 million. 

Since the attack, cautious investors have been moving their coins to other storage solutions — including exchanges.

Coinkite said in a statement this week that the bug in its software “silently went unnoticed” and “its potential impact grew with every release” of its products. 

Days after the first hack, the company urged investors to update their software or move their funds off the popular hardware wallet.