Third Wave of the Coldcard Exploit: Tactic-Shifting Attackers Reach $89 Million

As the attack targeting Coldcard hardware wallets reaches its third wave, the total amount stolen has approached the $89 million mark.

As security concerns continue to grow in the cryptocurrency world, attacks targeting users of the popular hardware wallet manufacturer Coldcard have entered a new phase. According to data shared by Galaxy Research, the attackers have changed tactics and begun draining wallets with smaller balances. In these operations, which have occurred in three waves, a total of 4,585 addresses have been victimized so far.

In the third wave detected Sunday morning, approximately 208 Bitcoin (BTC) were stolen from 1,912 different addresses. The average amount per victim in this wave remained just above 0.1 Bitcoin (BTC), significantly lower than the 1 Bitcoin (BTC) average in the first wave. In the first attack, 1,083 Bitcoin (BTC) were seized in just 41 minutes. The total loss has reached 1,367 Bitcoin (BTC).

Shifting Tactics and P2WSH in the Coldcard Attack

The third wave stands out with new techniques that make tracking the attacker more difficult. Unlike the first two waves, each victim’s assets are sent to separate destination addresses using the P2WSH (Pay-to-Witness-Script-Hash) output format. This format can accommodate complex conditions such as multi-signature or timelocks. Additionally, instead of scanning a single address each time, attackers are moving faster by aggregating an average of six victims into a single transaction.

The vulnerability is rooted in a March 2021 firmware update. A bug in this update caused wallet keys to be generated via predictable software rather than the hardware’s secure element. Galaxy Research has not yet clarified whether the same person is behind the attack or if a second operator noticed the vulnerability. However, the decreasing amount of loot suggests that the profitable key spaces are beginning to run dry and the attack is reaching its final stages.