Coldcard Security Flaw Exposes $130M in Bitcoin to Ongoing Attacks

A security vulnerability in certain Coldcard models has led to significant losses for Bitcoin holders. According to Galaxy Research, approximately $130 million worth of BTC was stolen across three confirmed waves of attacks, with a potential fourth wave still unconfirmed. The attacks appear to have started on July 30 and were likely carried out programmatically or with the assistance of large language models.

The vulnerability affects seeds generated on Mk3, Mk4, and Mk5 Coinkite devices as well as certain firmware versions of the Coldcard Q. Galaxy Research identified 1,596 BTC stolen from 7,300 addresses across the three confirmed waves, with an additional 14 smaller incidents also reported.

Notably, 90% of the stolen funds have not been moved, and all assets corresponding to waves 1, 2, and 3 remain static. Galaxy is actively collaborating with U.S. federal agencies, exchanges, and cybersecurity research groups to track the compromised addresses.