{"id":5253,"date":"2026-08-02T15:06:32","date_gmt":"2026-08-02T14:06:32","guid":{"rendered":"https:\/\/zawaya24.com\/en\/?p=5253"},"modified":"2026-08-02T15:06:32","modified_gmt":"2026-08-02T14:06:32","slug":"coldcard-wallet-exploit-losses-climb-to-89-million-after-third-attack","status":"publish","type":"post","link":"https:\/\/zawaya24.com\/en\/coldcard-wallet-exploit-losses-climb-to-89-million-after-third-attack\/","title":{"rendered":"Coldcard wallet exploit losses climb to $89 million after third attack"},"content":{"rendered":"

Losses linked to the Coldcard wallet exploit<\/strong> have reached 1,367 Bitcoin, worth about $88.6 million, after a third wave of attacks drained another 208 BTC from 1,912 addresses between Friday and Saturday. According to Galaxy Research, the campaign began on July 30 and has now affected 4,585 addresses across three separate attack waves, raising fresh concerns about the security of self-custody cryptocurrency storage.<\/p>\n

The first wave unfolded between 01:10 UTC and 01:51 UTC on July 30, stealing 1,082.65 BTC from 1,196 addresses in just 41 minutes. The attack continued for roughly 30 hours before Coinkite, the Canadian manufacturer of Coldcard hardware wallets, issued its first public warning. A second wave on July 31 extracted another 76.16 BTC from 1,478 additional addresses.<\/p>\n

Researchers said the third wave followed a different on-chain pattern. Instead of sending each victim’s funds individually, the attacker grouped an average of six victims per transaction and transferred assets to unique pay-to-witness-script-hash destinations. Galaxy Research believes each attack wave was carried out by a single operator but has not confirmed whether the same individual or group was responsible for all three.<\/p>\n

Investigators traced the vulnerability to a firmware modification introduced in March 2021. The change unintentionally redirected seed generation from the device’s hardware random number generator to a weaker software-based pseudo-random generator. Engineers found that affected Mk2 and Mk3 devices provided only about 40 bits of effective entropy instead of the expected 128 bits for a standard 12-word recovery phrase. Later Mk4, Mk5 and Q models generated roughly 72 bits, offering greater protection but still below the intended security level.<\/p>\n

The reduced entropy allowed attackers to recreate possible recovery seeds offline and compare them with publicly available blockchain data without needing physical access to the wallets.<\/p>\n

The incident triggered a wave of defensive fund transfers across the Bitcoin network. According to CryptoQuant, Bitcoin transactions involving less than one BTC reached 39,600 BTC on Friday, marking the highest daily level since the collapse of FTX in November 2022. Galaxy Research and several industry figures urged Coldcard users to move funds immediately if their wallets were created using affected firmware versions.<\/p>\n

Coinkite Chief Executive Rodolfo Novak apologized publicly and said the company accepts full responsibility for the firmware flaw. Emergency firmware updates have been released for all affected models. However, the update only protects newly generated recovery seeds and cannot secure seeds that were created before the fix. The company advised affected users to generate a new recovery seed using the patched firmware before carefully transferring their assets. Recovery seeds created manually with at least 50 fair dice rolls are not considered vulnerable.<\/p>\n

The incident also affected market sentiment. Spot Bitcoin exchange-traded funds recorded net daily outflows of $265 million following news of the exploit, while market sentiment dropped to its weakest level since April, according to data cited by FX Empire. CoinDesk reported that the attack had spread to roughly 4,500 addresses, while Jan3 Chief Executive Samson Mow urged all Coldcard users to transfer their digital assets immediately regardless of wallet model or firmware version.<\/p>\n

Galaxy Research cautioned that its estimate of $88.6 million in losses remains preliminary and could increase if additional compromised addresses are identified.<\/p>\n","protected":false},"excerpt":{"rendered":"

Losses linked to the Coldcard wallet exploit have reached 1,367 Bitcoin, worth about $88.6 million,…<\/p>\n","protected":false},"author":1,"featured_media":5254,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16],"tags":[4819,4818,4821,4820,4822],"class_list":["post-5253","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology","tag-bitcoin","tag-coldcard","tag-crypto-security","tag-firmware","tag-self-custody"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/zawaya24.com\/en\/wp-json\/wp\/v2\/posts\/5253","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zawaya24.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zawaya24.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zawaya24.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zawaya24.com\/en\/wp-json\/wp\/v2\/comments?post=5253"}],"version-history":[{"count":1,"href":"https:\/\/zawaya24.com\/en\/wp-json\/wp\/v2\/posts\/5253\/revisions"}],"predecessor-version":[{"id":5255,"href":"https:\/\/zawaya24.com\/en\/wp-json\/wp\/v2\/posts\/5253\/revisions\/5255"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/zawaya24.com\/en\/wp-json\/wp\/v2\/media\/5254"}],"wp:attachment":[{"href":"https:\/\/zawaya24.com\/en\/wp-json\/wp\/v2\/media?parent=5253"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zawaya24.com\/en\/wp-json\/wp\/v2\/categories?post=5253"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zawaya24.com\/en\/wp-json\/wp\/v2\/tags?post=5253"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}