Coldcard Wallet Exploit Sees Third Wave of Attacks Worth Nearly $90 Million

A third wave of attacks targeting vulnerable Coldcard-generated Bitcoin wallets has resulted in another $89 million loss, bringing total losses to nearly $89 million. According to Galaxy Research, the latest wave occurred between Friday midday and Saturday morning UTC, with 208 BTC drained from 1,912 addresses. This brings the total number of affected addresses to 3,108, with a total loss of 1,367 BTC.

Unlike the initial attacks, which averaged nearly one Bitcoin stolen per victim, the third wave took just over 0.1 BTC from each affected address. Researchers believe this suggests that the highest-value wallets have already been emptied. The first wave, launched on July 30, stole 1,083 BTC from 1,196 addresses in only 41 minutes.

The attacker is exploiting wallets created with compromised keys, which were generated due to a March 2021 Coldcard firmware release that mistakenly relied on a predictable software random number generator. This has allowed attackers to reproduce private keys offline with sufficient computing power. The stolen funds are being stored in pay-to-witness-script-hash (P2WSH) outputs, which support advanced features such as multisignature wallets and timelocks.