$89 Million Lost as Hacker Targets Vulnerable Coldcard Wallets

A series of hacks on Coldcard wallets has resulted in losses of nearly $89 million. According to Galaxy Research, the attacks started on July 30 and have continued into August, with a third wave of withdrawals reported over the weekend.

The attacker is believed to be targeting addresses whose keys were generated via Coldcard, using a vulnerability related to the firmware build released in March 2021. This build directed seed phrase generation to a predictable software-based randomness mechanism, leaving too narrow a set of possible keys that can be reproduced offline.

The attacks have affected over 4,500 addresses, with an average loss of just over 0.1 bitcoin per victim. The total damage from the three episodes has reached $89 million, with the number of affected addresses rising to 4,585.