Coldcard Exploit Tops $100M as Researchers Identify New Attack Clusters

The ongoing exploit targeting vulnerable Coldcard-generated Bitcoin wallets has surpassed $100 million in confirmed losses, with researchers warning that the attack remains active and could affect additional users.

The latest developments follow Galaxy Research’s initial investigation into the Coldcard wallet exploit, which revealed that attackers had drained millions of dollars in Bitcoin from wallets created using affected firmware.

Galaxy Research said confirmed thefts have now reached 1,596 BTC across three verified attack waves and several smaller incidents, involving approximately 7,300 wallet addresses.

Researchers Identify Wider Attack Activity

Galaxy Research said it has identified 14 additional exploit clusters through ongoing victim reports, suggesting that multiple actors may be taking advantage of the same underlying vulnerability.

The firm said 73 victims have contacted researchers to assist with tracing stolen Bitcoin, providing additional data on attacker wallets and transaction patterns.

Investigators also believe a fourth major attack wave may have occurred, although the incident has not yet been confirmed by affected users. If verified, estimated losses could rise to approximately 2,055 BTC, worth around $130 million based on current valuations.

The development suggests that the impact of the vulnerability may continue expanding as researchers identify previously unknown affected wallets.

Coinkite Urges Users to Move Vulnerable Bitcoin

Coldcard manufacturer Coinkite has issued a new warning urging users of potentially affected devices to immediately secure their funds.

The company advised users to:

• install updated firmware,

generate a new seed phrase,

and transfer Bitcoin to a newly created wallet.

Coinkite warned that compromised seeds remain vulnerable until users manually migrate their assets.

The company also clarified that wallets created using its optional dice-based entropy method are not affected by the vulnerability.

Seed Generation Flaw Behind Ongoing Losses

The exploit has been linked to a flaw introduced in a March 2021 Coldcard firmware update that weakened randomness during seed phrase generation for certain single-signature wallets.

Researchers said the issue did not directly compromise Coldcard hardware but affected the cryptographic process used to create private keys, making some wallet seeds potentially predictable.

Because private keys generated from affected seeds remain vulnerable indefinitely, researchers continue to advise users who created wallets during the affected period to move funds to newly generated wallets using verified entropy.

Self-Custody Debate Intensifies

The expanding scale of the exploit has renewed discussion around the risks and responsibilities associated with self-custody.

Hardware wallets are widely considered one of the safest methods for storing digital assets because private keys remain offline. However, the incident highlights that security depends not only on keeping keys offline but also on the integrity of the processes used to generate them.

For Bitcoin holders, the Coldcard exploit has become a reminder that even offline storage solutions require careful verification of firmware, wallet generation methods, and security practices.

As investigations continue, researchers and wallet providers are urging affected users to act quickly before additional vulnerable addresses are targeted.