Coldcard Hardware Wallet Exploit Costs Bitcoin Investors $88.6M

Crypto researchers at Galaxy have identified an exploit in the Coldcard hardware wallet, resulting in losses of over $88.6 million for Bitcoin investors.

The vulnerability is due to a firmware bug that reduced the randomness of how the wallet generates its secret recovery phrase, making it easier for hackers to drain funds from affected addresses.

The researchers have tracked three waves of hacks, with the latest one occurring in June and July. In total, they estimate that 1,367.05 BTC has been stolen across 4,585 addresses.

The loss profile suggests that individual self-custody holders are being targeted, with smaller addresses (sub-1 BTC) making up a large portion of the losses by count, but larger addresses in value.