What to know:
- Galaxy estimates 1,596 BTC stolen from 7,300 addresses across three attack waves so far.
- A suspected fourth theft wave could raise total losses to 2,055 BTC, or nearly $130M.
- Vulnerable Coldcard firmware used weak seed generation instead of hardware randomness.
Galaxy Research has linked the Coldcard exploit to 1,596 stolen Bitcoin across three confirmed attack waves. The losses came from 7,300 addresses. A suspected fourth wave could raise the total to about 2,055 BTC overall.
The research firm published its findings on Monday in a post on X. It valued the possible total at nearly $130 million. That figure was based on current Bitcoin prices and applies only if investigators confirm the additional losses.
Galaxy also identified 14 smaller security incidents. The firm connected them to the same seed-generation flaw. These cases increased the confirmed scope of the Coldcard exploit.
Also Read: Robinhood Wins UK Crypto Registration as New FCA Rules Approach
Why Galaxy Excluded the Fourth Wave
Galaxy has not added the suspected fourth wave. It lacks enough confirmation from affected wallet owners. The firm is waiting for more victims to verify the related addresses, which remain part of its suspected tally.
Blockchain activity points to another coordinated theft wave. Galaxy said one attacker likely accounted for a substantial share of the suspected activity. The firm expressed medium-high confidence in that assessment.
Alex Thorn first flagged the potential fourth wave on August 3. Thorn is the Galaxy’s head of firmwide research. The transactions observed were similar to the ones during the previous waves.
He estimated the number of stolen coins as 448.7 BTC. These coins were stolen from 709 probable victim addresses. However, Galaxy did not include that figure in the confirmed total.
How Galaxy Tracks the Coldcard Exploit
On-chain analysis has certain limitations in evaluating the Coldcard exploit, according to Galaxy. The on-chain evidence does not always confirm every suspected victim. It also cannot confirm that only one person committed each of the thefts related to the Coldcard exploit.
The research group at Galaxy continues to refine the address map with newly acquired data. Investigators review fresh data provided directly by the wallet owners. The team also takes into account the data from other participants in the investigation.
The bug affects seeds generated by the following Coldcard models: Mk3, Mk4, Mk5, and Coldcard Q. Every compromised wallet uses one of the vulnerable firmware versions.
Coinkite reported the Coldcard exploit last week. It traced the problem to work completed in March 2021. The bug was found in the process of integrating a new cryptographic library.
What Coldcard Users Should Do Next
The firmware had used a deterministic pseudo-random generator for wallet seeds. MicroPython supplied that generator. Instead, it had been supposed to use the hardware-backed random number generator.
That hardware generator kept operating in other parts of the firmware. Reviews showed that that component existed within the system. However, the mistake in the seed generation went undetected.
Coinkite estimated that devices Mk2 and Mk3 could generate 40 bits of entropy. The amount could be up to 72 bits for the vulnerable Mk4, Mk5, and Coldcard Q models. The intended level was 128 bits.
Galaxy said the Coldcard exploit remains active. It advised affected users to transfer funds to safer addresses. Owners should create entirely new wallet seeds on patched devices.
Also Read: BitMine Adds 10,399 ETH as Holdings Reach 4.8% of Ethereum Supply
Be the first to comment