Coldcard Users Hit by $88.6M Hack as Vulnerability Exploited

A hardware wallet vulnerability has led to a series of attacks on Coldcard users, draining over $88.6 million in Bitcoin from nearly 5,000 addresses.

The third wave of attacks, identified by Galaxy Research, targeted single-signature Coldcard addresses created after March 2021 and drained roughly 208 BTC from 1,912 victim addresses, averaging just over a tenth of a Bitcoin per victim.

Galaxy's head of research, Alex Thorn, is urging affected users to move funds immediately, as installing the new firmware alone does not protect existing funds. The company recommends generating a completely new seed, verifying the new backup and receiving address, and sending a small test transaction before migrating any remaining balance.