Tag: hack

  • Coldcard Bitcoin Wallet Sweeps Top $114 Million as Replace-by-Fee Rescue Window Opens

    Coldcard Bitcoin Wallet Sweeps Top $114 Million as Replace-by-Fee Rescue Window Opens

    Early Monday, a fourth wave of sweeping attacks targeted Bitcoin addresses generated by Coldcard wallets, pushing observed losses to approximately 1,816 BTC—worth around $114 million. Researchers have identified a narrow rescue window enabled by replace-by-fee (RBF), which allows victims to override unconfirmed theft transactions by paying a higher fee.

    Narrow Rescue Window

    Galaxy Research’s Alex Thorn flagged the active wave while transactions remained in Bitcoin’s mempool. He noted that attackers enabled replace-by-fee on their pending transfers, meaning victims who detect a targeted address can move their coins first by offering miners a higher fee. Thorn urged users to check balances, remove funds from affected devices, and raise transaction fees promptly.

    Thorn had no direct victim report when he published the warning. Instead, he relied on matching transaction patterns and chose speed while users still had time to respond.

    Predictable Seed Generation

    The first sweep began July 30, removing 1,083 BTC from 1,196 addresses within 41 minutes. Two weekend waves raised observed losses to 1,367 BTC across 4,585 addresses. The fourth wave lifted the possible total to about 1,816 BTC from more than 5,200 addresses. Thorn tracked activity across blocks 960,778 through 960,792.

    Researchers counted 218 transactions that targeted 462 victim addresses. The wave averaged about 14 sweeps per block, compared with 0.3 during a pre-incident control period. The flaw traces to a March 2021 firmware build that sent seed generation to a predictable software randomizer rather than the wallet chip’s hardware randomizer. As a result, anyone who identifies the relevant range can reproduce affected keys offline.

    Coinkite released emergency firmware for all affected models after the flaw was discovered. The manufacturer also instructed users who created seeds with the flawed software to move funds and use wallet addresses generated from fresh seeds.

    Transaction Patterns

    Every spent coin arrived after the Coldcard firmware boundary was identified by researchers. The attackers also sent each victim’s funds to a fresh destination with no previous transaction history. Unlike earlier waves, the fourth used one destination per victim instead of shared collector addresses, making the new activity harder to map through common destinations.

    None of the first three waves reached multisignature setups, matching a flaw tied to single-key seeds. Researchers also removed six old destination addresses as attacker-generated addresses should lack earlier activity. According to CryptoQuant Research Head Julio Moreno, small Bitcoin holders moved 39,600 BTC on July 31—transfers under 1 BTC reached about $2.5 billion that day. The last comparable total reached 39,900 BTC on November 16, 2022, days after FTX failed. Daily active addresses also climbed from 645,000 to almost one million, marking the highest level since December 2024. The increase centered on sending addresses rather than receiving addresses as news of the Coldcard flaw spread.

    Brief Roundup

    Four Coldcard-linked sweeps may have taken about 1,816 BTC from more than 5,200 addresses. Replace-by-fee gives users a narrow chance to override pending thefts. Anyone who created a seed with affected firmware should check funds, move coins to a fresh-seed wallet, and raise fees when necessary.

  • Coldcard Wallet Hack Exceeds $100 Million: 1,596 BTC Stolen Across 7,300 Addresses

    Coldcard Wallet Hack Exceeds $100 Million: 1,596 BTC Stolen Across 7,300 Addresses

    Galaxy Research has revised its estimate of the Coldcard wallet hack, now linking 1,596 Bitcoin (BTC) — worth over $100 million — to the exploit. The attack targeted approximately 7,300 addresses across three major waves and 14 smaller incidents. A suspected fourth wave could push total losses to 2,055 BTC, or roughly $130 million.

    Galaxy Raises Confirmed Theft Estimate

    Researchers at Galaxy received reports from 73 victims, which helped verify the three primary attack waves. The reports also revealed smaller transaction patterns that may involve other attackers exploiting the same vulnerability. The updated figure far exceeds the initial estimate of $70 million, as investigators continued to identify new addresses, victims, and transaction groups while the attacks unfolded.

    The first major wave began on July 30, draining approximately 1,082.65 BTC from 1,196 addresses in just 41 minutes. At the time, that Bitcoin was valued at about $70.2 million. Two subsequent waves followed. By August 2, researchers had traced roughly 1,367 BTC across 4,585 addresses. The third wave took about 208 BTC from 1,912 smaller accounts.

    Galaxy noted that each wave followed a consistent pattern, suggesting a single operator, but researchers could not definitively link every wave to the same attacker. It remains possible that additional attackers joined after the vulnerability was disclosed.

    Weak Seeds Exposed Private Keys

    The attackers did not compromise the Bitcoin network itself. Instead, they targeted recovery seeds generated by certain Coldcard firmware versions that used weak random data. A hardware wallet should generate a recovery seed from secure, unpredictable information — a process that creates entropy and protects private keys from offline guessing.

    Coldcard introduced the flaw during a firmware update in March 2021. Seed generation shifted from the device’s hardware random-number generator to software within the libNgU and MicroPython stack. An integration error then routed the process to MicroPython’s deterministic fallback, which relied heavily on device details and timing values. This drastically reduced the number of possible seeds, allowing attackers to generate candidate seeds offline, derive related Bitcoin addresses, and compare them with addresses on the blockchain — all without physical access to a victim’s device.

    Coinkite Lists Affected Firmware Versions

    Coinkite estimates that affected Mk2 and Mk3 wallets produced only about 40 bits of effective entropy. Mk4, Mk5, and Q models reached approximately 72 bits, still below the intended 128 bits. The advisory covers Mk2 and Mk3 firmware versions 4.0.1 through 4.1.9, Mk4 and Mk5 standard firmware before 5.6.0 and Edge firmware before 6.6.0X, and Coldcard Q standard firmware before 1.5.0Q and Edge firmware before 6.6.0QX. TAPSIGNER, OPENDIME, and SATSCARD use separate codebases and are not affected.

    The alert coincided with heavy movement from small Bitcoin addresses. Transfers below 1 BTC reached 39,600 BTC in one day, according to CryptoQuant research head Julio Moreno — the highest daily movement in that category since November 2022, when users moved about 39,900 BTC shortly after FTX collapsed. While not every transfer came from a Coldcard user, the timing suggests that some holders shifted funds to new wallets or exchanges after the security warning.

    Conclusion

    Galaxy Research has confirmed 1,596 BTC in losses across three attack waves and 14 smaller incidents. The flaw weakened recovery-seed randomness in several Coldcard firmware versions. Users with affected devices should follow Coinkite’s advisory and move funds to wallets created with secure, updated software.