Coldcard Bitcoin Exploit Balloons to $88 Million as Attackers Keep Draining Wallets
Researchers say the Coldcard hardware-wallet theft is still ongoing and has now reached about 1,367 BTC, or roughly $88.6 million, across 4,585 addresses. Galaxy Research reported a third wave of drains totaling 207.73 BTC and warned that users with single-signature funds on affected Coldcard devices should move them immediately. The flaw traces to a March 2021 firmware error that generated seed phrases with too little randomness, making private keys guessable. The stolen coins had often remained untouched for years before being swept, with an average dormancy of 3.18 years. Investigators have flagged about 600 suspected attacker addresses. Users are rushing to move funds to new wallets or exchanges, though some losses have already occurred, including a reported $1.6 million BTC theft from a Canadian user.
