Galaxy Research Documents $115 Million in Bitcoin Losses Linked to Coldcard Vulnerability

Galaxy Research reports that over $115 million worth of bitcoin has been reported missing following a targeted exploit of Coldcard hardware wallets. 

In a Sunday post on X, Galaxy Research confirmed it had interviewed more than 200 affected individuals to provide support and collect intelligence on the perpetrators. 

The valuations referenced are based on bitcoin’s market price at the time of the theft. 

Initial theft activity was detected on July 31, targeting bitcoin held in Coinkite’s widely used Coldcard hardware wallets. 

Coinkite, a Canadian firm, identified a firmware bug in Coldcard Mk3 devices dating back to version 4.0.1 released in March 2021. The flaw caused seed generation to default to a weak software-based pseudorandom number generator instead of the device’s hardware true random number generator, effectively enabling attackers to guess seed phrases. 

The total of stolen funds has continued to grow as attackers target newer devices, despite warnings from Coinkite and other community members urging users to immediately transfer their assets. 

Last week, Galaxy Research estimated that a minimum of 15 independent actors were exploiting the vulnerability. 

Earlier Galaxy Research indicated that stolen coins typically remained undisturbed for approximately 3.5 years, and that roughly 88% of pilfered funds had been inactive for at least one year. 

The firm continues to quantify the full scope of the breach, noting that total losses may surpass $130 million. 

In the aftermath, numerous investors have begun relocating their holdings to alternative storage options, including centralized exchanges. 

Coinkite acknowledged in a recent statement that the software bug ‘silently went unnoticed’ and that its potential impact expanded with each product release. 

Shortly after the initial breach, the company urged affected users to update their firmware or immediately move funds off the Coldcard wallet. 

Source link