Losses from a major security breach affecting Coldcard hardware wallets have now exceeded $115 million, according to data compiled by Galaxy Research. The firm, which offers digital asset market insights and research, reported reaching out to over 200 victims to gather further details and support impacted users.
Attack details and vulnerability
The attack, first identified at the end of July, targeted the Coldcard hardware wallet manufactured by Canadian company Coinkite. The breach was traced to a critical firmware bug present in Coldcard Mk3 devices running software versions beginning with 4.0.1, which was released in March 2021.
Coinkite revealed that the vulnerability caused the device’s seed generation process to default to a weak software Pseudorandom Number Generator rather than the intended hardware-based true random number generator. This flaw enabled hackers to predict user seedphrases and gain unauthorized access to their bitcoin holdings.
The issue affected recent devices, leading Coinkite and several industry figures to urge Coldcard users to immediately relocate their assets to alternative storage solutions or update their wallet firmware to mitigate risks.
ETH
SOL
BSC
ROBINHOOD
USDT
AAPLMini dictionary: Pseudorandom Number Generator (PRNG) — A software-based algorithm that generates numbers simulating randomness, but which can be predictable if the internal state or algorithm is compromised. True random number generators (TRNGs) use physical processes to ensure unpredictability, a key requirement for cryptographic applications.
Scale of the losses
Galaxy Research calculated the total loss at $115 million, based on market prices at the moment coins were stolen. The number continues to rise as more users report missing funds. Investigators stated that as many as 15 independent groups exploited the vulnerability simultaneously.
The firm also discovered that the majority of stolen funds had been dormant for significant periods: Galaxy’s analysis showed the average compromised bitcoin account had not moved for 3.5 years, and 88% of the stolen assets were idle for over a year before being taken.
| Metric | Statistic |
|---|---|
| Total reported losses | $115 million |
| Suspected attackers | 15 independent groups |
| Average coin dormant period | 3.5 years |
| Portion held over 1 year | 88% of pilfered funds |
Recent analysis by Galaxy Research estimates the total value of stolen bitcoin at $115 million, based on valuations at the time of each incident. The firm noted that attackers have targeted both older and more recently activated Coldcard Mk3 devices, with many affected wallets left untouched for years before being drained.
Company response and ongoing efforts
Coinkite, the Canadian manufacturer of Coldcard wallets, acknowledged the severity of the bug and its expanding impact over several firmware releases. The company advised customers to upgrade their device firmware or transfer their bitcoin to more secure wallets following the discovery.
Coinkite described the issue as a critical flaw that “silently went unnoticed,” emphasizing the urgent need for cold wallet holders to review the security of their devices.
Galaxy Research indicated that the total amount stolen could eventually surpass $130 million, as their investigation into further affected accounts continues. Since the breach, a noticeable migration of assets has taken place, with some investors shifting their bitcoin to exchanges or alternative hardware wallets.
