Crypto researchers say Bitcoin investors have now lost more than $88 million to an exploit in the Coldcard hardware wallet.
Researchers at Galaxy say BTC is being drained from addresses by bad actors in waves, due to a firmware bug that dramatically reduced the randomness of how the wallet creates its secret recovery phrase.
“A 3rd wave in what we suspect are hacks of Coldcard-generated addresses has been identified in which 207.7294 BTC has been drained. Our estimated observed size of the Coldcard hack is now 1,367.05 BTC (~$88.6m) across 4,585 addresses…
Waves 1 and 2 followed similar patterns: the same funnel topology into a handful of shared collectors, the same P2WPKH destinations, the same mix of derivation paths, 27 hours apart. Treating them as one operator is reasonable, but it rests on resemblance, not on proof, and they already differ in two respects — the fee constant, and whether the sweeps signal replace-by-fee.
Even if we can assume Waves 1 and 2 are the same attacker, Wave 3 should not be assumed to be the same operator. It differs from both earlier waves on every behavioural axis we can measure: it abandons the shared collector for one destination per victim, it holds in P2WSH rather than P2WPKH, it batches an average of 6.37 victims into each sweep where wave 1 took exactly one, and it scans only the default derivation path.
It may be the same actor with rebuilt tooling — the anti-clustering design is exactly the evolution one would predict after waves 1 and 2 were enumerated — or it may be a second actor working the same vulnerable key space independently, which the published disclosures make entirely feasible. The chain does not distinguish these, nor can we…
The loss profile is dominated by sub-1 BTC addresses in count, but by larger addresses in value. This appears to be the shape of individual self-custody, not institutional holdings.
The vulnerable Coldcard firmware shipped on March 17, 2021 around block 674,951. Not one of the coins we have identified in Waves 1-3 taken was created before that block.”
The theft has triggered a scramble among Coldcard users to protect their funds.
Galaxy researchers say some initial addresses came from victim reports on X and were used to map the on-chain patterns.
They warn that this data is derived solely from analyzing Bitcoin block data and the unspent-output set, and they have not used compute to confirm whether the addresses identified as possible victims were actually generated with low entropy.
Follow us on X, Facebook and Telegram
Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox
 
Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any assets including cryptocurrencies, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.
Generated Image: DALLE3
#Bitcoin #Holders #Lose #Coldcard #Crypto #Wallet #Exploit #Galaxy #Researchers