Coldcard Bitcoin Exploit Balloons to $88M as Attackers Keep Draining Wallets

9 hours ago

Galaxy Research reports approximately $88.6 million stolen from 4,585 Coldcard addresses across three waves of theft.
The exploit, stemming from a March 2021 firmware flaw that caused weak seed phrase randomness, is ongoing and likely LLM-orchestrated.
Every single-signature Coldcard address created after the vulnerable firmware version is expected to be drained eventually.
Affected users are moving Bitcoin back to centralized exchanges, reversing the typical 'not your keys, not your coins' principle.
Example victim Jonathan Goodman lost 18.25 BTC despite secure key storage, highlighting the stealthy nature of the attack.

A vulnerability in a March 2021 Coldcard firmware release enabled attackers to drain bitcoin from thousands of wallets by reproducing keys generated with weak software-based randomness.
Three distinct attack waves have swept 1,367 bitcoin (nearly $89 million) from 4,585 addresses, with the latest wave targeting smaller balances and using more complex, harder-to-trace transaction patterns.
Galaxy Research believes each wave is the work of a single operator but cannot determine if the same attacker is behind all three due to blockchain limitations.

A Coldcard firmware flaw enabled attackers to steal nearly 600 bitcoin worth about $38 million, one of the biggest failures of Bitcoin self-custody.
Security experts warn that the hack underscores growing operational risks in self-custody as cyber threats evolve, including software, hardware, and supply-chain risks.
The incident may accelerate the shift toward regulated custodians and spot Bitcoin ETFs, with some analysts advising investors to hold funds on exchanges or ETFs instead of managing private keys.

Block's Bitcoin Engineering and Security teams identified vulnerabilities in COLDCARD firmware allowing Bitcoin theft.
Vulnerability stems from an RNG integration error where ngu.random uses a deterministic Yasmarang fallback instead of the hardware RNG.
Affected devices include Mk2/Mk3 v4 (no secure reseed), Mk4/Q/Mk5 (limited 32-bit reseed), while Mk1 and older firmware are unaffected.

A hacker breached Romania's cadastre agency, wiping the entire land registry database after a failed extortion attempt, halting the real-estate market.
Hugging Face was hacked using an autonomous AI agent, stealing internal datasets and cloud credentials, while guardrails hindered their response analysis.
A critical WordPress vulnerability (CVE-2026-63030, wp2shell) allows remote unauthenticated attackers to execute code, affecting versions since last December.

A CDN caching bug on RubyGems.org potentially exposed one user's legacy API key to another for up to an hour, affecting clients older than v3.2.0 (specifically using GET /api/v1/api_key with gzip compression).
The bug resulted from a specific interaction between response compression and cache headers, allowing cached responses at Fastly edge nodes to serve incorrect keys without re-authenticating.
All legacy API keys have been revoked as a precaution, and users are urged to check their gems for unauthorized versions, yanks, owners, or webhooks.

A vulnerability in a March 2021 Coldcard firmware release enabled attackers to drain bitcoin from thousands of wallets by reproducing keys generated with weak software-based randomness.
Three distinct attack waves have swept 1,367 bitcoin (nearly $89 million) from 4,585 addresses, with the latest wave targeting smaller balances and using more complex, harder-to-trace transaction patterns.
Galaxy Research believes each wave is the work of a single operator but cannot determine if the same attacker is behind all three due to blockchain limitations.

A Coldcard firmware flaw enabled attackers to steal nearly 600 bitcoin worth about $38 million, one of the biggest failures of Bitcoin self-custody.
Security experts warn that the hack underscores growing operational risks in self-custody as cyber threats evolve, including software, hardware, and supply-chain risks.
The incident may accelerate the shift toward regulated custodians and spot Bitcoin ETFs, with some analysts advising investors to hold funds on exchanges or ETFs instead of managing private keys.

Block's Bitcoin Engineering and Security teams identified vulnerabilities in COLDCARD firmware allowing Bitcoin theft.
Vulnerability stems from an RNG integration error where ngu.random uses a deterministic Yasmarang fallback instead of the hardware RNG.
Affected devices include Mk2/Mk3 v4 (no secure reseed), Mk4/Q/Mk5 (limited 32-bit reseed), while Mk1 and older firmware are unaffected.

A hacker breached Romania's cadastre agency, wiping the entire land registry database after a failed extortion attempt, halting the real-estate market.
Hugging Face was hacked using an autonomous AI agent, stealing internal datasets and cloud credentials, while guardrails hindered their response analysis.
A critical WordPress vulnerability (CVE-2026-63030, wp2shell) allows remote unauthenticated attackers to execute code, affecting versions since last December.

A CDN caching bug on RubyGems.org potentially exposed one user's legacy API key to another for up to an hour, affecting clients older than v3.2.0 (specifically using GET /api/v1/api_key with gzip compression).
The bug resulted from a specific interaction between response compression and cache headers, allowing cached responses at Fastly edge nodes to serve incorrect keys without re-authenticating.
All legacy API keys have been revoked as a precaution, and users are urged to check their gems for unauthorized versions, yanks, owners, or webhooks.

Hasty Briefsbeta