Coldcard Wallet Hackers Siphon $89 Million in Bitcoin

A 5-year-old security vulnerability in Coldcard's firmware has allowed attackers to steal nearly $89 million in bitcoin.

The exploit, which was discovered in a 2021 firmware release, permitted hackers to siphon bitcoin from thousands of wallets in three waves of attacks.

Losses across the three waves added up to 1,367 bitcoin from 4,585 addresses, with researchers suggesting that each wave is likely the work of one attacker.

Coldcard acknowledged the issue on its website and advised users to migrate to a new key using 'care and calm', warning that rushing a wallet migration could create more immediate risk.