Bitcoin cold-wallet attack spreads to 4,500 addresses as losses near $89M

4 hours ago

A vulnerability in a March 2021 Coldcard firmware release enabled attackers to drain bitcoin from thousands of wallets by reproducing keys generated with weak software-based randomness.
Three distinct attack waves have swept 1,367 bitcoin (nearly $89 million) from 4,585 addresses, with the latest wave targeting smaller balances and using more complex, harder-to-trace transaction patterns.
Galaxy Research believes each wave is the work of a single operator but cannot determine if the same attacker is behind all three due to blockchain limitations.
The flaw routed seed generation to a predictable software randomizer instead of the chip's hardware one, leaving a bounded set of possible keys that can be reproduced offline.
The latest wave sends each victim's coins to its own destination rather than shared collector addresses, and uses pay-to-witness-script-hash outputs with multisignature or timelock conditions.

Galaxy Research reports approximately $88.6 million stolen from 4,585 Coldcard addresses across three waves of theft.
The exploit, stemming from a March 2021 firmware flaw that caused weak seed phrase randomness, is ongoing and likely LLM-orchestrated.
Every single-signature Coldcard address created after the vulnerable firmware version is expected to be drained eventually.

A Coldcard firmware flaw enabled attackers to steal nearly 600 bitcoin worth about $38 million, one of the biggest failures of Bitcoin self-custody.
Security experts warn that the hack underscores growing operational risks in self-custody as cyber threats evolve, including software, hardware, and supply-chain risks.
The incident may accelerate the shift toward regulated custodians and spot Bitcoin ETFs, with some analysts advising investors to hold funds on exchanges or ETFs instead of managing private keys.

Block's Bitcoin Engineering and Security teams identified vulnerabilities in COLDCARD firmware allowing Bitcoin theft.
Vulnerability stems from an RNG integration error where ngu.random uses a deterministic Yasmarang fallback instead of the hardware RNG.
Affected devices include Mk2/Mk3 v4 (no secure reseed), Mk4/Q/Mk5 (limited 32-bit reseed), while Mk1 and older firmware are unaffected.

A fake Tronscan blockchain explorer appeared as the #1 search result on DuckDuckGo, prompting users to connect their wallet and leading to a drainer.
Attackers exploit SEO on Bing and DuckDuckGo to rank phishing sites high, using gateway domains that silently redirect to rotating phishing pages.
The drainer scans victims' wallets after connection, requesting approval for unlimited TRC-20 tokens and claiming TRX via smart contracts.

Anthropic's Claude Mythos Preview discovered new attacks on cryptographic algorithms, including a significant weakening of the HAWK post-quantum digital signature scheme and an improved attack on reduced-round AES.
The HAWK attack reduces its effective key strength by half, discovered in about 60 hours with minimal human guidance, while the AES attack improves the speed of previous best attacks by 200-800 times.
Neither attack currently affects production systems: HAWK is only a candidate scheme, and the AES attack targets a weakened variant with fewer rounds.

Galaxy Research reports approximately $88.6 million stolen from 4,585 Coldcard addresses across three waves of theft.
The exploit, stemming from a March 2021 firmware flaw that caused weak seed phrase randomness, is ongoing and likely LLM-orchestrated.
Every single-signature Coldcard address created after the vulnerable firmware version is expected to be drained eventually.

A Coldcard firmware flaw enabled attackers to steal nearly 600 bitcoin worth about $38 million, one of the biggest failures of Bitcoin self-custody.
Security experts warn that the hack underscores growing operational risks in self-custody as cyber threats evolve, including software, hardware, and supply-chain risks.
The incident may accelerate the shift toward regulated custodians and spot Bitcoin ETFs, with some analysts advising investors to hold funds on exchanges or ETFs instead of managing private keys.

Block's Bitcoin Engineering and Security teams identified vulnerabilities in COLDCARD firmware allowing Bitcoin theft.
Vulnerability stems from an RNG integration error where ngu.random uses a deterministic Yasmarang fallback instead of the hardware RNG.
Affected devices include Mk2/Mk3 v4 (no secure reseed), Mk4/Q/Mk5 (limited 32-bit reseed), while Mk1 and older firmware are unaffected.

A fake Tronscan blockchain explorer appeared as the #1 search result on DuckDuckGo, prompting users to connect their wallet and leading to a drainer.
Attackers exploit SEO on Bing and DuckDuckGo to rank phishing sites high, using gateway domains that silently redirect to rotating phishing pages.
The drainer scans victims' wallets after connection, requesting approval for unlimited TRC-20 tokens and claiming TRX via smart contracts.

Anthropic's Claude Mythos Preview discovered new attacks on cryptographic algorithms, including a significant weakening of the HAWK post-quantum digital signature scheme and an improved attack on reduced-round AES.
The HAWK attack reduces its effective key strength by half, discovered in about 60 hours with minimal human guidance, while the AES attack improves the speed of previous best attacks by 200-800 times.
Neither attack currently affects production systems: HAWK is only a candidate scheme, and the AES attack targets a weakened variant with fewer rounds.

Hasty Briefsbeta