Coldcard Attack Drains up to $110 Million in Bitcoin From Thousands of Addresses, Researchers Say

Users of a popular bitcoin storage device, Coldcard, are being urged to protect or move their cryptocurrency after it was discovered that a software issue might have allowed attackers to allegedly steal upwards of $110 million over the past several days.A report from Galaxy Research over the weekend estimated that around $88 million, or 1,367.05 bitcoin, was stolen from 4,585 addresses in the Coldcard attack.The data, it said, was “derived solely from analyzing Bitcoin block data and the unspent-output set” and added that its “analysis represents our best effort on short notice and should not be considered to be complete or definitive, and is for informational purposes only.”The cryptocurrency addresses were “drained” in three waves through Coldcard, a device used to store cryptocurrency, and that in each successive attempt, “intervening blocks contain no identifiable hacker sweep activity, suggesting that the sweep transactions were broadcast in batches rather than streamed,” Galaxy Research wrote.In an update, Alex Thorn, the head of firmware research at Galaxy Research, said in a post on X that a fourth likely “organized wave” targeted Coldcard owners on Sunday evening.According to Thorn, around 388 bitcoin were stolen in the latest wave of attacks, bringing the total stolen funds to more than $110 million.He then warned in all-capitalized text: “Move your funds off Coldcard devices [as soon as possible].”Coinkite, which owns Coldcard, issued an alert over the security issue, advising users of the devices to create a recovery phrase using its updated software. They are then advised to move their bitcoin to a newly secured wallet.“Updating the firmware does not repair a seed that was generated by affected firmware,” the company said the advisory, updated on Aug. 1. “A new seed must be generated and the funds migrated to the new wallet.”On Sunday evening, Coinkite wrote on X that “the last three days have been some of the hardest in this company’s history, and for a lot of the people reading this, they’ve been something much worse.”“Money that took years to save, gone. Trust that took years to build, broken,” it added. “That impact is real, and for some, the damage is permanent. Some are asking hard questions about our company. We are, too.”The company wrote that it is “working directly” and communicating with its customers in a bid to help them move funds it considers “still safe to move.”“If you have an affected device, please do not dispose of it. It may become essential if funds are recovered,” Coinkite advised in the post.“Our legal team will coordinate as warranted with law enforcement across multiple jurisdictions to support efforts in identifying those responsible.”The company did not confirm the reports from Galaxy Research or the amount of funds that were apparently stolen.Coinkite did not respond to a request for comment by publication time.