Coldcard Wallet Bug Losses Reach $90 Million Amid Ongoing Attack

The recent Coldcard wallet bug has led to losses of over $90 million in Bitcoin, making it one of the most damaging self-custody failures in recent memory. The incident began on July 30 and has continued with a series of nine distinct waves, with over 1,400 BTC stolen from more than 5,400 wallet addresses.

The attackers are not simply running an automated script, but actively monitoring vulnerable wallets and timing their withdrawals accordingly. Security researchers believe multiple independent actors are exploiting the same weakness, with some linked to North Korea's Lazarus Group.

As the community debates partial solutions, such as multisig wallets or passphrase protection, security professionals caution that these measures can backfire for less technical users. The incident has also highlighted the need for clearer disclosure timelines when vulnerabilities are discovered and for independent audits of hardware wallet firmware.