15 attackers now draining vulnerable Coldcard wallets, report
There are 15 separate attackers draining BTC from Coldcard customers’ hardware wallets, Galaxy Research concluded on Tuesday morning — and more thieves seem to be arriving by the day.
As the exploitation of last week’s newly-discovered firmware flaw continues, estimated victim losses have topped $130 million from 7,300 wallets and rising.
Given the number of affected wallets, there are probably thousands of victims, and many long-term holders might not even be aware of their losses. Galaxy Research has heard from 73 victims as of Monday.
The fifteenth attacker surfaced overnight after an owner reported losing less than a single BTC. That report led Galaxy to identify an uncatalogued attacker who had already pulled 12 BTC out of 126 wallet addresses.
Galaxy filed the attacker’s on-chain behavior under footprint “O,” the fifteenth letter of the alphabet.
Researchers are labeling each footprint as victims come forward, and the letters are still going up.
Because the vulnerability is public knowledge, any hacker with sufficient knowledge and computational power can join the crime wave.
Stealing money from Coldcard users simply requires scanning Bitcoin’s blockchain for vulnerable wallets and brute-force guessing of private keys that have low entropy due to Coldcard’s faulty firmware.
Read more: What to do if you’re a Coldcard victim
The Coldcard attack keeps getting worse
Coldcard firmware routed wallet seed generation into MicroPython’s software fallback, a pseudo-random number generator rather than true random generator.
Coinkite, the device manufacturer, estimates that the seed phrases its devices generated contained only “about 40 bits” on its Coldcard Mk2 and Mk3 models — far below its 128-bit target.
Later models like Coldcarrd Mk4 land at “about 72 bits,” the company concedes — still far lower entropy than is required to protect customers from brute-force computation.
Unfortunately, the public keys associated with these weak private keys sit on a public ledger accessible on a worldwide, permissionless basis. The opening wave of thefts occurred last week, a few hours before Coinkite issued any advisory.
Coinkite co-founder Rodolfo Novak wrote on July 31, “We take full accountability for the firmware bug and we offer our sincere apologies to those affected.” Coinkite has since shipped hotfixes for every affected model and release track.
It warned again today, “The threat is still active.”
Affected wallet owners must move their BTC to safekeeping. “Updating the firmware does not repair a seed that was generated by affected firmware,” the company notes in its post-mortem.
Interestingly, the hackers are keeping most of their BTC without immediate attempts to spend or liquidate their ill-gotten proceeds.
Galaxy reports that “90% of stolen coins haven’t moved. 100% of coins in Waves 1, 2, and 3 have not moved.”
Law enforcement departments around the world are investigating the criminal activity. If you’re a Coldcard victim, consider reporting your loss to local and federal officials.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.