Coldcard exploit reveals years-long Bitcoin theft campaign — Details

It’s been 18 days, and the impact of the Coldcard exploit starting on 30th July is still being felt. Galaxy Research spoke to more than 200 victims on 16th August to understand the intelligence behind the attack. 

The compromised coins were produced on the day the vulnerable Coldcard firmware was released. This happened on 17th March 2021, when Bitcoin [BTC] had reached a block height of 674,951. The timing is what makes this attack noteworthy since it also links the exploit to a seed-generation flaw.

In such types of flaws, the illicit actors usually predict or forge the stolen wallet seed entropy. 

An assessment of the losses

Here, it’s worth noting that the time period between 2021 and 2022 saw the largest concentration of stolen addresses.

Also, only a small percentage of the 8,680 addresses in Galaxy’s published theft set have been directly connected to victims who reported losses. This, even though they hold approximately 1,778.6 BTC

Additionally, all 192 individuals reported losses involving addresses in the dataset that was made public, which includes roughly 1,790 addresses and 714.8 Bitcoin.

AMBCrypto recently reported that these losses surpassed 1,596 BTC worth more than $100 million across roughly 7,300 addresses. Given Bitcoin’s price on 16th August though, the total losses have now surpassed $115 million.