The Coldcard Attack Has Grown to $89M — CZ: "Nothing Is 100%"

The damage from an exploit in Coldcard hardware wallets keeps growing: according to the latest figures from Galaxy Research, an attacker has now stolen roughly 1,367 BTC (about $89 million) from 4,585 addresses across a third wave of attacks. The first wave, on July 30, drained 1,083 BTC (about $70 million) from 1,196 addresses in just 41 minutes, while the third wave, spanning Friday into Saturday UTC, added another roughly 208 BTC from 1,912 addresses — this time targeting smaller balances, around a tenth of a bitcoin per victim.

• The root cause is a Coldcard firmware bug dating to March 2021: the device generated seed phrases through a predictable software algorithm instead of its hardware random-number generator
• A firmware update doesn't protect seeds already generated on vulnerable devices — funds need to move to a freshly generated set of keys
• Coinkite, Coldcard's maker, released emergency patches and urged affected users to migrate to new seed phrases on uncompromised devices
• Galaxy Research believes all three waves trace back to the same operator, though it stops short of formally linking them

“Nothing is 100%.”

— Changpeng Zhao (CZ), Binance founder, on X

CZ urged bitcoin holders not to rely on a single device or seed phrase, and to spread funds across multiple wallets instead. A similarly skeptical take on hardware wallets has come up before: on-chain investigator ZachXBT previously called all hardware wallets "garbage" and trashed Ledger, proposing an unconventional alternative. If you're picking a hardware wallet for the first time, we have a separate breakdown of the top 5 hardware wallets for beginners. More detail on how the Coldcard attack has unfolded is available via CoinDesk.

This article is for informational purposes only and does not constitute investment advice.