Coldcard firmware flaw drains $88.6M from 4,585 wallets

A sophisticated, ongoing attack targeting Bitcoin stored in Coldcard hardware wallets has now drained approximately 1,367 BTC, worth roughly $88.6 million, from 4,585 addresses, according to researchers. The thefts, which began on July 30, have occurred in three distinct waves, with the latest sweep of 207.73 BTC identified on August 2, indicating the campaign is still active.

The exploit stems from a critical firmware flaw in Coinkite's Coldcard Mk3 devices. A build error in versions 4.0.1 through 5.0.3, released in March 2021, caused the devices to generate wallet seed phrases with insufficient randomness, making the resulting private keys predictable. This vulnerability means that any single-signature wallet created with affected firmware after that update is at risk, regardless of whether the device was later updated or kept offline. Researchers warn that every such vulnerable address will eventually be drained.

The attack methodology appears highly deliberate. Analysis by blockchain intelligence firms indicates the attacker used automated tools to study and prioritize wallets with the largest balances first, siphoning an estimated $30 million within the first 10 minutes....