Coldcard Wallets Drain $70M in 41-Minute Attack

A recent attack on Coldcard wallets resulted in the loss of over $70 million worth of Bitcoin. The incident occurred on July 30, when a total of 1,196 wallets were drained of their funds within a 41-minute window.

The researchers behind the discovery attributed the vulnerability to a firmware flaw in certain Coldcard hardware wallets, which made supposedly unguessable seed phrases computationally enumerable. This allowed attackers to reconstruct private keys without ever touching the devices.

Security teams found that the range of keys generated by affected devices collapsed from unimaginably vast to countable, making it possible for an attacker to generate candidate seeds on their own hardware and derive addresses to check against the public blockchain.

The victims spanned three address formats, which is what a scanner looks like. Galaxy warned further waves are likely if owners do not move their funds.