Tag: Galaxy Research

  • Coldcard Firmware Bug Led to $70M Bitcoin Heist, Researchers Say

    Coldcard Firmware Bug Led to $70M Bitcoin Heist, Researchers Say

    Galaxy Research has linked a firmware flaw in Coldcard hardware wallets to the theft of 1,082.65 Bitcoin, worth approximately $70 million. The coordinated withdrawals, which occurred across 1,196 addresses on July 30, took place within just 41 minutes, marking one of the largest reported hardware wallet incidents this year.

    Galaxy Tracks a Coordinated Bitcoin Theft

    Galaxy Research identified a consistent transaction pattern across the stolen funds, pointing to a single attacker behind the operation. However, the firm cautioned that the observed transfers may not include all exposed wallets. Other vulnerable addresses could remain inactive or be moved later. Blockchain records cannot distinguish between theft and a legitimate owner transfer when both use valid private keys, leaving the true extent of the breach uncertain.

    Coinkite Expands Warning Across Coldcard Models

    Coinkite initially warned owners of Coldcard Mk3 devices running firmware version 4.0.1, released in March 2021, that seeds created with the affected software could expose user funds. The company later widened the advisory to include selected firmware versions on Coldcard Mk4, Mk5, and Coldcard Q devices. Emergency updates were issued for every impacted model. Coinkite CEO Rodolfo Novak (NVK) accepted responsibility and apologized to customers, stating that the company’s internal review process failed to catch the defect before release.

    AI-Assisted Analysis Raises New Security Concerns

    Novak suggested that attackers may have discovered the flaw through artificial intelligence-assisted code analysis. Such tools can detect subtle weaknesses faster than traditional manual reviews, creating a growing challenge for software developers. While AI can help defenders inspect code, it also shortens the path from public release to exploitation.

    What Affected Users Should Do

    Coinkite urged affected users to take the following steps:

    • Install the latest firmware version.
    • Create new wallet seeds.
    • Move Bitcoin into new wallets after testing small transfers first.
    • Keep original backups until every transfer succeeds.

    Coldcard wallets store private keys offline, but firmware bugs, supply chain risks, and configuration errors can still create attack paths. Galaxy Research linked the July 30 theft to vulnerable Coldcard wallet seeds across affected firmware versions. Coinkite released emergency updates and told users to create fresh seeds, test new wallets, and transfer funds while keeping original backups until every move succeeds.

  • Coldcard Wallet Hack Exceeds $100 Million: 1,596 BTC Stolen Across 7,300 Addresses

    Coldcard Wallet Hack Exceeds $100 Million: 1,596 BTC Stolen Across 7,300 Addresses

    Galaxy Research has revised its estimate of the Coldcard wallet hack, now linking 1,596 Bitcoin (BTC) — worth over $100 million — to the exploit. The attack targeted approximately 7,300 addresses across three major waves and 14 smaller incidents. A suspected fourth wave could push total losses to 2,055 BTC, or roughly $130 million.

    Galaxy Raises Confirmed Theft Estimate

    Researchers at Galaxy received reports from 73 victims, which helped verify the three primary attack waves. The reports also revealed smaller transaction patterns that may involve other attackers exploiting the same vulnerability. The updated figure far exceeds the initial estimate of $70 million, as investigators continued to identify new addresses, victims, and transaction groups while the attacks unfolded.

    The first major wave began on July 30, draining approximately 1,082.65 BTC from 1,196 addresses in just 41 minutes. At the time, that Bitcoin was valued at about $70.2 million. Two subsequent waves followed. By August 2, researchers had traced roughly 1,367 BTC across 4,585 addresses. The third wave took about 208 BTC from 1,912 smaller accounts.

    Galaxy noted that each wave followed a consistent pattern, suggesting a single operator, but researchers could not definitively link every wave to the same attacker. It remains possible that additional attackers joined after the vulnerability was disclosed.

    Weak Seeds Exposed Private Keys

    The attackers did not compromise the Bitcoin network itself. Instead, they targeted recovery seeds generated by certain Coldcard firmware versions that used weak random data. A hardware wallet should generate a recovery seed from secure, unpredictable information — a process that creates entropy and protects private keys from offline guessing.

    Coldcard introduced the flaw during a firmware update in March 2021. Seed generation shifted from the device’s hardware random-number generator to software within the libNgU and MicroPython stack. An integration error then routed the process to MicroPython’s deterministic fallback, which relied heavily on device details and timing values. This drastically reduced the number of possible seeds, allowing attackers to generate candidate seeds offline, derive related Bitcoin addresses, and compare them with addresses on the blockchain — all without physical access to a victim’s device.

    Coinkite Lists Affected Firmware Versions

    Coinkite estimates that affected Mk2 and Mk3 wallets produced only about 40 bits of effective entropy. Mk4, Mk5, and Q models reached approximately 72 bits, still below the intended 128 bits. The advisory covers Mk2 and Mk3 firmware versions 4.0.1 through 4.1.9, Mk4 and Mk5 standard firmware before 5.6.0 and Edge firmware before 6.6.0X, and Coldcard Q standard firmware before 1.5.0Q and Edge firmware before 6.6.0QX. TAPSIGNER, OPENDIME, and SATSCARD use separate codebases and are not affected.

    The alert coincided with heavy movement from small Bitcoin addresses. Transfers below 1 BTC reached 39,600 BTC in one day, according to CryptoQuant research head Julio Moreno — the highest daily movement in that category since November 2022, when users moved about 39,900 BTC shortly after FTX collapsed. While not every transfer came from a Coldcard user, the timing suggests that some holders shifted funds to new wallets or exchanges after the security warning.

    Conclusion

    Galaxy Research has confirmed 1,596 BTC in losses across three attack waves and 14 smaller incidents. The flaw weakened recovery-seed randomness in several Coldcard firmware versions. Users with affected devices should follow Coinkite’s advisory and move funds to wallets created with secure, updated software.

  • Coldcard Firmware Bug Leads to $70M Bitcoin Theft From 1,196 Wallets

    Coldcard Firmware Bug Leads to $70M Bitcoin Theft From 1,196 Wallets

    An attacker drained 1,082.65 Bitcoin, worth approximately $70 million, from 1,196 wallets during a 41-minute sweep on July 30. Galaxy Research mapped the full event after early reports captured only part of the theft.

    Galaxy Maps a Batched Bitcoin Sweep

    Galaxy found that the attacker moved the bitcoin between 01:10 and 01:51 UTC across six blocks. Three blocks between those transfers contained no related transactions. That pattern indicates the operator broadcasts transactions in batches rather than sending them continuously. The stolen bitcoin now sits in four addresses and has not moved.

    Early coverage tracked only one destination address, which kept the first loss estimate much lower. Galaxy later connected the remaining addresses and nearly doubled the reported amount. The attacker drained 1,183 native SegWit wallets, seven older standard addresses, and six still older addresses. This mix points to systematic seed testing across several derivation paths.

    Firmware Error Reduced the Seed Range

    Coldcard devices should create seeds with a dedicated hardware random number generator. An internal build setting instead told affected firmware to skip that generator. A supporting library checked whether the setting existed but failed to check whether developers had enabled it. The software then used a fallback tied to the chip serial number and clock registers.

    The serial number remains fixed, while an attacker can narrow or reproduce clock timing. As a result, the possible seeds fell from an immense range to a searchable set. Security teams reproduced key generation on older Mk2 and Mk3 devices. For the Mk4, Q, and Mk5, they estimated a range of about four billion possible seeds. An attacker can generate candidate seeds, derive their addresses, and compare them with the public blockchain. The victim’s hardware never needs to connect during that search.

    Device Scope Dispute Leaves Owners Exposed

    Galaxy warned that more sweeps could follow unless affected owners move their funds. Owners cannot run a test that shows whether their seed falls inside the reproducible range. Coinkite, Coldcard’s maker, warned Mk3 owners and said newer models remain unaffected. Block’s report also placed the Mk2, Mk4, Q, and Mk5 within the affected scope.

    The disagreement leaves users without a verified way to separate safe devices from exposed ones. Anyone who generated a seed with affected firmware must treat that seed as vulnerable. Block’s Clay Garrett said the operator used a paid account at a well-known blockchain data provider. Internal logs reportedly matched the suspected queries by number, timing, and sequence. The provider supplied standard services and saw no clear sign of the attacker’s purpose. Block passed the account information and related evidence to authorities.

    Conclusion

    Galaxy Research traced the theft to 1,196 wallets and four holding addresses. The seed-generation flaw reduced key security to a searchable range, while reports disagree on affected models. Galaxy warned that further sweeps could follow, making fund movement the only action described for potentially exposed owners.

  • Galaxy Research Lowers CLARITY Act Passage Odds to 50% Amid Senate Calendar Constraints

    Galaxy Research Lowers CLARITY Act Passage Odds to 50% Amid Senate Calendar Constraints

    Galaxy Research has reduced its estimate for the CLARITY Act becoming law in 2026, citing growing pressure on the US Senate calendar. The research firm lowered its forecast from 60% to 50%, emphasizing that the main challenge is timing rather than support for the legislation.

    Alex Thorn, Galaxy’s head of firmwide research, explained that lawmakers face a limited window to advance the crypto market structure bill before Congress enters its August recess. He noted that several legislative priorities continue to compete for Senate floor time.

    Scheduling Delays and Limited Senate Floor Time

    Galaxy Research said the latest revision reflects delays in the legislative process instead of concerns about the contents of the CLARITY Act. Thorn wrote that “as the Senate calendar tightens and a lack of progress in negotiations makes passage less likely than several weeks ago.”

    According to Thorn, the bill still lacks a unified Banking-Agriculture Committee text. In addition, Senate leaders have not announced a floor date or scheduled a motion to proceed. These missing steps have reduced confidence that lawmakers can complete the process within the available time.

    Galaxy previously reduced its estimate from 75% to 60% earlier in June. The latest adjustment brings the projected odds to an even 50-50 as lawmakers continue negotiations on unresolved sections of the proposal.

    Thorn stressed that the downgrade relates to legislative timing rather than the bill itself. The research team continues to view the legislation as capable of advancing if Congress schedules enough debate before the summer break.

    Other Legislative Priorities Increase Pressure on the CLARITY Act

    The Senate calendar has become more crowded after President Donald Trump stated that he would not sign a bipartisan housing bill unless Congress also passed the SAVE Act. Thorn said the dispute has reduced available floor time for other measures, including the CLARITY Act.

    He also noted that lawmakers must address other major items, including Section 702 of the Foreign Intelligence Surveillance Act and the National Defense Authorization Act for fiscal year 2027. These measures require Senate attention before the August recess.

    Thorn wrote, “For a 60-vote bill that still needs a merged Banking-Agriculture text, a motion to proceed, floor debate, an amendment process, and then House action on whatever the Senate produces, the runway is quickly declining into just a matter of weeks.”

    He added that Senate Majority Leader John Thune should announce floor time by early July. Without a scheduling decision, Thorn said the bill could move into September, when midterm political considerations may make difficult votes harder to schedule.

    Crypto Industry Continues to Watch the Bill’s Progress

    The CLARITY Act aims to establish a federal regulatory framework for digital assets in the United States. The proposal would divide oversight between the Securities and Exchange Commission and the Commodity Futures Trading Commission, while assigning primary authority over most crypto assets to the CFTC.

    The legislation has remained a major topic of discussion among lawmakers, digital asset companies, financial institutions and advocacy groups. While more than 200 crypto organizations have urged Congress to approve the bill, other groups have raised concerns about regulatory oversight and financial safeguards.

    The bill is scheduled for a House hearing on July 17 as lawmakers continue discussions. Industry participants are monitoring the Senate calendar closely because the remaining legislative timetable may determine whether the proposal advances this year.

    Despite lowering the probability estimate, Galaxy Research maintained that the legislation still has a realistic path forward. Thorn wrote, “We still think enactment this year has a strong chance — for a bill of this magnitude and complexity, 50-50 are pretty good odds.” The coming weeks are expected to determine whether Senate leaders allocate enough time to move the bill through the remaining legislative stages.