Coldcard Wallets Hit by Coordinated Attacks Worth Over $110M

A major security flaw in Coldcard hardware wallets has led to a series of coordinated attacks, draining over $110 million worth of Bitcoin from approximately 5,000 wallets.

The vulnerability was introduced in a March 2021 firmware release and affects certain Coldcard Mk3 versions. Coinkite released emergency firmware to prevent the issue from affecting newly generated wallets, but the update does not repair seeds already created on vulnerable firmware.

A total of four waves of attacks have been detected so far, with the latest wave pilfering 388.93 BTC worth $24.53 million from 462 addresses across 218 transactions.