$88.6M Stolen from Coldcard-Generated Bitcoin Addresses in Series of Attacks

A $88.6 million theft from Bitcoin addresses generated by Coldcard hardware wallets has been identified by Galaxy Research.

The researchers found three distinct waves of transactions, totaling 1,367.05 BTC, across 4,585 addresses.

The attacks span two patterns that appear to be the work of a single operator and a third pattern that may indicate an upgraded method or a separate offender targeting the same vulnerable key space.

Coldcard wallets are designed to provide the gold standard of self-custody security, using air-gapped signing and multiple layers of physical protection. However, the fact that attackers may have drained funds without touching the physical device raises questions about the security of these wallets.