Bitcoins Stolen in Hardware Wallet Attacks Are Moving: Losses Rise to $144 Million

Galaxy Research reported that 45 percent of the funds stolen in the third wave of attacks targeting Coldcard hardware wallets have been moved, and with the addition of 58 new addresses, the estimated loss has risen to 1,806 Bitcoins, approximately $143.9 million.

The Coldcard attacker continued to transfer stolen Bitcoins to different addresses; it was reported that they moved 45 percent of the funds stolen as part of the third wave.

So far, 97.09 Bitcoins have been spent. A portion of these assets was put through the CoinJoin method, which bundles transactions from multiple participants to make it difficult to trace funds. It was stated that the attacker is moving from large balances toward smaller ones.

Estimated Loss in Coldcard Attacks Has Grown

Galaxy had previously linked a loss of approximately 1,779 Bitcoins to 190 victims and more than 8,600 addresses. In the latest investigation, it was reported that a group of 58 previously unknown addresses, thought to belong to Coldcard victims, was also linked to the same movements. With this update, the estimated total loss rose to 1,806 Bitcoins.

The attacks emerged on July 30. The source of the problem was a bug in the firmware that Coinkite sent to Coldcard devices in 2021. The bug reduced the randomness used by the wallets when generating recovery words. Attackers exploited this vulnerability to guess the private keys of some single-signature wallets and withdrew funds without physical access to the devices.

Approximately 82 percent of the total stolen assets are still in the initial addresses under the attacker’s control. The remaining portion was moved through various transactions.