We do not use cookies of this type.
We do not use cookies of this type.
We do not use cookies of this type.
Install NewsLayer
Get the app experience — one tap from your home screen, instant loads and breaking-news alerts.
New data from Galaxy Research shows that $115 million in bitcoin has been lost in the Coldcard theft.
Why This Matters
The losses and the weak seed-generation flaw represent a material hardware-wallet security incident, potentially affecting users of Coldcard Mk3 firmware across several years and enabling multiple independent attackers. It could undermine confidence in self-custody hardware, while the movement of funds to exchanges may increase custody and market-structure risks for affected Bitcoin holders.
Security Context
Market Context
Bitcoin
BTC
$64,923
+1.21% 24h
Layer Index
Neutral
↓ 1 pts in 24h
New data from Galaxy Research shows that $115 million in bitcoin has been lost in the Coldcard theft.
Writing on X Sunday, Galaxy Research said that it had spoken with over 200 victims to support them and gather intelligence on the attackers.
The figures are based on the price of bitcoin at the time of the attack.
Hackers started taking bitcoin stored using Coinkite’s popular Coldcard hardware wallet on July 31.
Canadian company Coinkite said that a firmware bug in Coldcard Mk3 devices — starting with version 4.0.1 in March 2021 — caused seed generation to fall back to a weak software Pseudorandom Number Generator instead of the hardware true random number generator, allowing hackers to essentially guess investor seedphrases.
The number has slowly risen as the criminals have targeted more recent devices while Coinkite and other Bitcoiners have urged Coldcard users to immediately move their funds.
Galaxy Research last week said that it estimates at least 15 separate attackers were exploiting the bug independently.
Previous research from Galaxy found that the typical stolen coin had sat untouched for 3.5 years, and a striking 88% of pilfered funds were at least a year old.
The firm is still confirming how much is stolen, and has said that total losses could exceed $130 million.
Since the attack, cautious investors have been moving their coins to other storage solutions — including exchanges.
Coinkite said in a statement this week that the bug in its software “silently went unnoticed” and “its potential impact grew with every release” of its products.
Days after the first hack, the company urged investors to update their software or move their funds off the popular hardware wallet.
Enjoyed this story?
Follow Mathew Di Salvo and get alerted the moment their next story goes live.
Follow the Story
Dernière Minute
Advertisement
Related Intelligence
Sourced by
Originally reported by Bitcoin Magazine
NewsLayer coverage based on externally reported material.
The Daily Brief
Curated markets, onchain insights, and key headlines — delivered every weekday morning.
Weekdays · Free · ~5 minute read
Markets, regulation and onchain intelligence in a 5-minute morning read — plus breaking alerts and Layer Index flips as they happen.
The Daily Brief
Breaking alerts
Index flips
Free · No spam · Unsubscribe anytime
