Coldcard Attacks Drain $88.6M from Bitcoin Addresses

Researchers at Galaxy Research have identified three distinct attacks that drained $88.6 million from Bitcoin addresses generated by Coldcard hardware wallets.

The attacks, which spanned two patterns and a third wave that suggests either an upgraded method or a separate offender, targeted 4,585 addresses across the cryptocurrency network.

Coldcard devices are considered to be among the most secure options for self-custody due to their air-gapped signing and multiple layers of physical security. However, the attacks appear to have compromised these defenses without requiring interaction with the wallet device or its PIN.