Coldcard Wallets Hit by Multi-Attacker Exploit

A vulnerability in Coldcard hardware wallets allowed at least 15 attackers to exploit and steal funds from affected users. According to Galaxy Digital's head of research, Alex Thorn, the thefts involved multiple attacker addresses and independently controlled wallets.

The estimated losses total around $130 million, with approximately $100 million confirmed across three attack waves. Researchers suspect a fourth wave may have also occurred, increasing overall losses. The attackers did not directly access the air-gapped devices but instead recreated possible recovery phrases to monitor associated Bitcoin addresses for funds.

Coldcard wallets that relied on a deterministic pseudorandom number generator instead of a hardware-based one were affected. This reduced effective randomness protecting some private keys, making it easier for attackers to search for valid seed phrases. Users with potentially affected wallets have been advised to update their firmware and generate new seed phrases.