coldcard

According to monitoring by Bitcoin News, new research published by @PraveenPerera shows that Coldcard attackers seem to first identify addresses with vulnerabilities, then sort them by the amount of Bitcoin held, starting to transfer in batches from the addresses with the highest holdings. The transfer software used was relatively crude.One address had 225 spendable UTXOs, and the attackers extracted exactly the latest 200, leaving the earliest 25, which included a UTXO worth 0.16 BTC. This aligns perfectly with the limitation of a blockchain API investigated by researchers, which defaults to returning 200 records, indicating that the attackers may have failed to load the next page of data. The software even spent a UTXO of 294 satoshis, reportedly increasing the transaction fee by about 2040 satoshis, with the spent amount significantly higher than the value of the UTXO itself.The authors of the study believe that the builders of this tool may have a better understanding of the account balance system than of the Bitcoin UTXO model. Although the attackers seem to have obtained the complete seed of the victims, at least 75 BTC still remain in other addresses derived from the same seed. The biggest suspicion currently is that among the 153 stolen addresses, there are still 132.95 BTC, and researchers have been unable to reproduce the seed behind these addresses, so it cannot be ruled out that the attackers obtained undisclosed private device data or candidate data.

After the Coldcard hardware wallet firmware vulnerability was exploited, approximately 2,100 bitcoins were stolen, resulting in a loss of nearly $130 million. On-chain data shows that long-term holders transferred about 233,000 bitcoins from their wallets in the days before and after the incident, worth approximately $15 billion.Casa CEO Nick Neuman stated that some of the transferred funds came from Coldcard users migrating to multi-signature wallets, and Ledger and Trezor users also took similar measures after the incident. During the same period, about 22,000 bitcoins were transferred to exchanges. Coinkite has requested that users who generated recovery phrases using firmware versions 4.1 to 4.1.9 consider the related wallets compromised and immediately migrate to new recovery phrases. The aforementioned versions cover from March 2021 to July 2026.

According to The Block, due to the wallet migration triggered by the Coldcard vulnerability, the number of new Bitcoin addresses surged from about 260,000 to over 330,000 last week, reversing the downward trend that persisted for most of 2026.Since July 30, Coinkite hardware wallet users have lost at least 1,816 BTC (approximately $116 million) in four waves of attacks. The vulnerability originated from a firmware defect in 2021—using a less secure software random number generator when generating mnemonic phrases instead of the device's built-in hardware entropy source, allowing attackers to brute-force wallets generated offline. Coinkite has advised users who generated wallets between March 2021 and the release of the security patch to migrate to new wallets.This incident highlights the risks associated with self-custody, as users are reassessing the pros and cons of self-custody versus custodial solutions like centralized exchanges or ETFs.

The hardware wallet Coldcard has been hacked, and the total losses are currently uncertain. The blockchain analysis platform CryptoQuant confirmed the loss to be 1432 bitcoins, while Galaxy Research provided a high-confidence minimum value of 1730 bitcoins. Other analyses suggest that the scale of the losses may be even higher.Research institution Galaxy Research stated that its earlier estimate of 1816 bitcoins is a potential value and not a confirmed total. As of Tuesday, the institution confirmed a high-confidence minimum loss of 1730 bitcoins, with over 450 bitcoins confirmed based on reports from victims. Blockchain intelligence company TRM Labs estimated that the attackers transferred about 1816 bitcoins from over 5200 addresses in four stages. CryptoQuant indicated that its confirmed data only includes addresses publicly disclosed by victims and verified through on-chain patterns, and the statistics may rise as more victims disclose information.

According to Forbes, the scale of the theft in the Coldcard hardware wallet vulnerability incident has risen to approximately $130 million, involving about 2,000 BTC and over 5,200 addresses, reigniting the industry's debate over who should hold private keys. Data from Bitcoin Magazine shows that in the days following the incident, the net inflow into U.S. spot Bitcoin ETFs was $626 million, with some opinions suggesting that the vulnerability may drive more funds towards ETFs.Reports indicate that supporters of self-custody remain undeterred. Casa co-founder Jameson Lopp stated that confidence in self-custody should not be lost due to recent events, as custodial institutions also rely on random number generators. Bitcoin core early developer Peter Todd noted that the historical record of self-custody is far better than that of third parties. Another viewpoint argues that both reflexive choices have flaws. Onramp co-founder Michael Tanguma stated that if the only answer is Coinbase or ETFs, it poses a serious problem, as centralizing what should be decentralized assets undermines their foundation, advocating for a multi-institutional custody solution where keys are held by multiple regulated entities.

A wallet security incident involving approximately $130 million in Bitcoin losses is reigniting discussions in the crypto industry about asset custody models: should Bitcoin holders rely on personal self-custody or turn to institutional custody? Hardware wallet manufacturer Coldcard had a vulnerability in its firmware in 2021 that led to some mnemonic phrases generated by the device being predictably risky. This vulnerability was discovered years later, and approximately 5,200 addresses and about 2,000 BTC have been stolen, with losses amounting to around $130 million.After the incident, some investors began to turn to Wall Street custody products. Data shows that the U.S. spot Bitcoin ETF saw a net inflow of about $626 million within days of the incident. Bloomberg ETF analyst Eric Balchunas stated that such security incidents could further drive funds into ETFs. However, the Bitcoin core community still insists on the self-custody concept. Casa co-founder Jameson Lopp stated that recent events should not undermine users' confidence in self-custody and pointed out that third-party custody also carries risks. Bitcoin Core early developer Peter Todd also believes that self-custody has a better long-term safety record than centralized institutions.Onramp co-founder Michael Tanguma believes that both options have flaws. He stated that concentrating a large amount of assets in a single institution creates a "honey pot," while hardware wallets face risks related to supply chains, firmware, and random number generation. Tanguma proposed a "multi-institution custody" solution, where multiple regulated institutions hold keys through a multi-signature mechanism, requiring multiple institutions to jointly sign any transaction to reduce single points of failure. However, this model has also sparked controversy. Critics argue that while multi-institution custody enhances security, it also introduces permissioned management, conflicting with the decentralized ideals originally pursued by Bitcoin. As Bitcoin gradually enters the fields of pensions, trusts, and institutional asset allocation, the industry is seeking new custody solutions suitable for long-term wealth management. The Coldcard vulnerability incident once again highlights that achieving a balance between security, decentralization, and usability remains a core challenge facing the Bitcoin ecosystem.

Bloomberg senior ETF analyst Eric Balchunas posted on the X platform that Bitcoin spot ETFs recently recorded the strongest weekly inflow since April of this year, with a net inflow of approximately $1 billion, marking the third-best performance since last October's "Silent IPO" event. Several products, including BlackRock's iShares Bitcoin Trust ETF (IBIT) and Fidelity's Fidelity Wise Origin Bitcoin Fund (FBTC), have seen inflows for multiple trading days following the Coldcard wallet incident.Eric Balchunas added that while a causal relationship cannot be fully confirmed, the strong correlation between fund flows and the timing of events is "hard to ignore." If it is ultimately proven that the Coldcard incident becomes the starting point for the next Bitcoin rally, it would be somewhat ironic—because attacks on Bitcoin cold storage wallets are typically viewed as one of the worst security incidents, yet market sentiment may shift as a result. Recent ETF fund inflows indicate that institutional investors' demand for Bitcoin allocation is recovering, and the market is reassessing the impact of previous security incidents.

According to a post by Galaxy Research, as of now, approximately 1719 BTC have been confirmed stolen in the Coldcard hardware wallet vulnerability attack, valued at around 111 million USD. Several other transactions are still under verification, and the total loss is expected to exceed 130 million USD. If the unverified portion is ultimately confirmed, the scale of theft could reach over 2300 BTC. In addition, collaborating researchers have received reports from more than 250 victims. Based on the loss situation from the first three waves, most victims are ordinary Bitcoin holders rather than whales.Galaxy Research stated that it is currently tracking over 25 independent attack patterns, including the previous first to third waves, indicating that multiple different threat actors are actively exploiting the vulnerability. All addresses corresponding to the stolen coins were created after the affected firmware was released on March 17, 2021. There is currently no evidence that the vulnerability affects other signing devices or wallets outside of the Coldcard Mk3, Mk4, Mk5, and Q series firmware released after that date.

The cryptocurrency hardware wallet manufacturer Coldcard has released an update on its customer data retention policy. Due to legal compliance requirements arising from the security incident disclosed on July 30, the company has temporarily suspended its original automatic customer data deletion mechanism.Previously, Coldcard's standard practice was to automatically clear customer records after 120 days, retaining only the user's email address and country information, while allowing customers to request early deletion of data at any time after product delivery. Coldcard stated that due to the security incident involving ongoing and potential legal proceedings, the company is obligated to retain records that may be relevant to litigation. Therefore, customer data that was originally scheduled for deletion will be temporarily retained until the law permits the resumption of normal processes.However, users can still request Coldcard to handle their personal information according to the original data retention policy. If users wish for their data not to be included in this legal retention scope, they can contact official customer service to make a request. Coldcard emphasizes that the retained data will be strictly protected, accessible only to authorized personnel, and will not be used for any purposes other than fulfilling legal obligations. The company will restore the previous automatic data deletion mechanism once legally permissible.

DefiLlama data shows that in July, hackers stole $247 million in crypto assets, making it the second highest month since 2026, only behind April's $644 million; this amount is a significant increase compared to June's $75 million and May's $60 million.Galaxy Digital stated that the Coldcard vulnerability was the largest attack event of the month, confirming three rounds of attacks involving 7,300 wallets, with at least $100 million in Bitcoin stolen; it also identified a suspected fourth round of attacks, which could bring total losses to about $130 million. The DefiLlama hacker tracker estimates that the losses related to this vulnerability amount to $115 million.Other attacks in July included a $9 million attack on the decentralized finance protocol Bonzo Lend, the theft of $2.6 million from the Cardano-based wallet SecondFi, the theft of $24 million from the Arbitrum-based perpetual trading platform AFX, and the theft of $7.5 million from the Verus Ethereum Bridge.

According to Lookonchain monitoring, the Coldcard hacker who stole 2,055 BTC, worth $130 million, is active again.1 hour ago, the hacker transferred 30.185 BTC to a new wallet, worth $1.94 million.

The Galaxy research director posted on platform X, stating that please continue to share your victim experiences with him via private message. His private messages are full, with over 200 Coldcard victims having contacted him. He is categorizing them using clanker and will eventually reply to everyone.He stated, "You will get through this, Bitcoin will get through this, we will not leave."

Bitcoin News posted on the X platform that new community honeypot tests show that attackers are still prioritizing wallets that are most easily exploited due to the Coldcard Mk3 RNG vulnerability.Researcher @ColeTU injected funds into 5 affected Mk3 wallets: 1 using only the vulnerable mnemonic, 3 protected by BIP39 passphrases of 1, 2, and 3 words respectively, and another using a random account number. After 14 hours, only the unprotected wallet using just the mnemonic had its funds transferred away. According to @jamesob's real-time tripwire dashboard, currently only 2 out of 17 honeypot wallets have been emptied. The emptied wallets have been confirmed not to have added extra entropy, while all wallets protected by dice rolls, passphrases, multisig, or other complexities remain untouched.The test results indicate that attackers are currently focusing on the wallets that are easiest to brute-force rather than investing resources in strengthening targets, but affected users should still migrate their funds immediately instead of relying on temporary protections.

According to monitoring by Bitcoin News, Galaxy Research stated that the largest known COLDCARD theft involved 1159 BTC, spread across seven attacker addresses, which have not yet been utilized, with 0 BTC cashed out or transferred through mixers. The related BTC was stolen within 41 minutes, but approximately 600 attacker addresses have been flagged by law enforcement, exchanges, and blockchain analysis companies.Meanwhile, a smaller-scale attacker seems to have begun laundering funds. On-chain analysts tracked 64 BTC entering a mixer, of which only about 10 BTC were initially mixed, and 54 BTC were returned as change, which was then split into outputs of about 7 BTC for further mixing. Analysts noted that these unusually large outputs remain easy to trace, making this laundering attempt relatively transparent.

CertiK stated that its monitoring system detected two transactions of 200 ETH each being transferred to Tornado Cash, and the related funds are associated with the ongoing Coldcard Wallet attack incident.The aforementioned funds were previously transferred from BTC to an Ethereum address via THORChain, and then subsequently transferred to Tornado Cash.

Cryptoquant released a report stating that on July 31, as Coldcard users rushed to transfer funds, on-chain activity surged dramatically. The number of daily active Bitcoin addresses soared from 645,000 on July 30 to nearly 1 million, the highest level since December 10, 2024, almost entirely driven by sending addresses. The total amount of transfers below 1 BTC on that day reached 39,600 BTC, slightly below the 39,900 BTC recorded after the FTX collapse; the total amount of transfers below $100,000 reached $3.2 billion, a new high since November 21, 2024.Long-term holder spending jumped from 269,000 BTC on July 30 to 406,000 BTC, the highest since January 14. The exchange recharge volume for small holders surged to the highest level since February 6. The mempool transactions increased from 33,000 to about 96,000, the highest since June 20. Analysis indicates that a large number of users have taken action to migrate funds, but an unknown number of holders still face risks.

Chainalysis posted on platform X that the Coldcard hack is particularly devastating for Canadian Bitcoin holders. Our analysis of the attackers and victims found that Canadian BTC holders accounted for 25% of the attributable losses.According to estimates compiled by Galaxy Research, the losses could be as high as $110 million, and we analyzed the geographical distribution of this ongoing hacking attack. Users in Australia, the United States, and Thailand also experienced significant losses.

According to Bitcoin News monitoring, a new real-time dashboard is mapping the ongoing exploitation of the COLDCARD vulnerability in real-time. @jamesob is deploying honeypot wallets and gradually increasing additional entropy, including dice rolls and mnemonic phrases, to measure the current brute-force cracking boundaries.The control wallet with an additional entropy value of 0 was emptied in 1 hour and 18 minutes. The project's goal is to determine the types of wallets that attackers can currently crack and how this capability changes over time.