Coldcard Hackers Strike for Over $89 Million in Bitcoin

A major security breach has affected users of Coinkite's Coldcard hardware wallet, resulting in an estimated $89 million loss. The attack began on July 30 and was tracked by Galaxy Research, which reported that over a 41-minute window, 1,082.65 Bitcoin ($70 million) were drained from 1,196 addresses.

The researchers believe the funds were transferred to four attacker-controlled addresses, possibly through an automated process. They also identified subsequent attacks on August 1, bringing the total stolen to 1,367 Bitcoin ($88.6 million) and increasing the victim address count to 4,385.

The breach is linked to a firmware vulnerability dating back to 2021, which allowed attackers to reproduce user wallet seeds offline. The Coldcard exploit has been ongoing since July 30, with Galaxy Research warning users to move their funds to safe locations immediately.