Coldcard Exploit Nets Over $100 Million in Stolen Bitcoin

The Coldcard exploit, which began on July 30th, has had far-reaching consequences, impacting over 200 victims and resulting in significant losses for Bitcoin holders. According to Galaxy Research, the compromised coins were produced on March 17th, 2021, when the vulnerable Coldcard firmware was released.

The timing of this exploit is noteworthy as it coincides with a seed-generation flaw, which typically involves predicting or forging wallet seed entropy by illicit actors.

A total of 8,680 addresses have been compromised in this attack, with only a small percentage directly connected to victims who reported losses. These losses amount to approximately 1,778.6 BTC and are spread across roughly 7,300 addresses.

Further investigation has revealed various patterns of destination and transaction behavior among the attackers, including Wave 1, which stole around 1,082.65 BTC from blocks 960,183-960,191.