Bitcoin cold-wallet attack spreads to 4,500 addresses as losses near $89 million - coindesk.com

2 min readMake preferred on ShareShare this articleCopy linkX iconX (Twitter)LinkedInFacebookEmailMake preferred on Hacker facing screens with lines of code (Boitumelo/Unsplash)#se-_R_99qanpfiupanivb_ .document-body > p:first-of-type::first-letter{float:none!important;font-size:inherit!important;line-height:inherit!important;margin-right:0!important;margin-top:0!important;font-weight:inherit!important}SummaryShowA vulnerability in a March 2021 Coldcard firmware release has enabled attackers to systematically drain bitcoin from thousands of wallets by reproducing keys generated with weak software-based randomness.Three distinct waves of attacks have now swept 1,367 bitcoin—nearly $89 million at recent prices—from 4,585 addresses, with the latest wave targeting smaller balances and using more complex, harder-to-trace transaction patterns.Galaxy Research believes each wave is the work of a single operator, but cannot determine whether the same attacker is behind all three, as the blockchain does not reveal whether separate sweeps are coordinated.The attacker working through Coldcard-generated keys is now emptying wallets worth a few thousand dollars each. Galaxy Research flagged a third wave of sweeps early Sunday, roughly 208 bitcoin drained from 1,912 addresses between Friday midday and Saturday morning UTC. That is just over a tenth of a bitcoin per victim. The July 30 opening wave averaged close to a full coin, 1,083 bitcoin from 1,196 addresses in 41 minutes. Observed losses across all three waves now total 1,367 bitcoin, nearly $89 million, from 4,585 addresses. Wave three sends each victim’s coins to its own destination rather than the handful of shared collector addresses that made the first two easy to map, and parks them in pay-to-witness-script-hash outputs, a format that can carry multisignature or timelock conditions, instead of the plain single-key outputs used before. It batched an average of six victims into each sweep where wave one took exactly one at a time, and it scanned only the default derivation path, the standard branch of the key tree a wallet checks first, instead of testing several branches per seed. That is either the same operator rebuilding after being enumerated in public or a second one grinding the same vulnerable key space independently, and the chain does not distinguish them. Galaxy said it is confident each wave is internally one operator, and will not link the three. The flaw traces to a March 2021 firmware build that routed seed generation to a predictable software randomiser instead of the chip’s hardware one, leaving a bounded set of possible keys that anyone with the disclosure and enough compute can reproduce offline, without ever touching a device. But the sweeping has not stopped almost three days later, and the falling average haul says the profitable end of that key space is already picked over. Related AssetsBitcoin$62,498.310.77%Latest Crypto News 1Solo Bitcoin miner nets $200,000 as Coldcard hardware wallet drains rocks sentiment41 minutes ago2Bitcoin, ether decline as Coldcard exploit enters a fifth day1 hour ago3Bithumb now targets 2028 IPO after major internal restructuring1 hour ago4Live updates: Traders say bitcoin sell-off from $65,000 points to thin volume, not panic selling1 hour ago5The bitcoin futures yield collapse: Once over 20%, now less than Treasury notes1 hour ago6Robinhood wins UK crypto registration before new regulatory regime kicks off2 hours ago7Coldcard wallet losses may near $114 million as possible fourth sweep emerges3 hours ago8U.S. Jobs, Circle, Galaxy, American Bitcoin earnings: Crypto Week Ahead3 hours ago9Bitcoin slips under $63,000 despite Iran deal hopes as Coldcard losses rattle market5 hours ago10Trump Media’s bitcoin stash may be down to loan collateral after $165 million BTC move6 hours agoLatest Research The Evolution of the Crypto CEX Landscape: A Case Study on BinanceThe Evolution of the Crypto CEX Landscape: A Case Study on BinanceBinance remains crypto’s leading exchange, expanding from spot and derivatives into RWAs, payments, savings, yield, and broader financial services. Binance remains crypto’s leading exchange, expanding from spot and derivatives into RWAs, payments, savings, yield, and broader financial services. Binance remains crypto’s leading exchange, expanding from spot and derivatives into RWAs, payments, savings, yield, and broader financial services.