Coldcard Vulnerability Leads to Over $70 Million in Bitcoin Losses, Nearly 1,200 Addresses Cleared

Galaxy Research reports that the Coldcard hardware wallet vulnerability has resulted in nearly 1,200 addresses being emptied, involving 1,082.65 BTC worth approximately $70.2 million. Fund flow analysis shows that between July 30, UTC time 01:10:20 and 01:51:26, a total of 1,196 addresses were subject to fund transfers. Coldcard manufacturer Coinkite issued a security warning, stating that the wallet seeds generated by some Coldcard Mk3 devices are at risk, with the affected range expanding to some Mk4, Mk5, and Coldcard Q firmware versions, and has released an emergency firmware update. Coinkite CEO Rodolfo Novak apologized for the incident, stating that the company takes full responsibility for the firmware vulnerability, and warned that AI-assisted code reviews could potentially identify vulnerabilities more quickly, making it easier for attackers to exploit security flaws in publicly available code. Galaxy Research noted that future attacks targeting addresses generated by Coldcard may still occur, and this fund flow pattern only proves that the related funds were transferred by the same attacker, without fully revealing the exploitation process.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.