Coldcard Hackers Strike Again, Stealing $88.6 Million from 4,585 Addresses

A second wave of attacks on Coldcard hardware wallet users has been reported by Galaxy Research, pushing the total amount stolen to $88.6 million from 4,585 addresses.

The first wave occurred on July 30, with 1,082.65 BTC stolen from 1,195 addresses in 41 minutes, and a second wave began 27 hours later, lasting three hours and 42 minutes, with another 76.16 BTC stolen from 1,478 addresses.

The researchers noted that the sets of affected addresses do not overlap, indicating that the attacker used a tool to work through an enumerated key space.

Coldcard maker Coinkite released an urgent warning covering multiple device models, stating that wallets are at risk if their seed phrases were created on vulnerable firmware versions without using at least 50 independent dice rolls or a strong BIP-39 passphrase.