Galaxy

Security

Grow

Bitcoin

A fourth wave of suspected attacks targeting Coldcard hardware wallet users has been identified, Galaxy Research's Head of Research Alex Thorn (<a href="https://x.com/intangiblecoins" rel="noopener noreferrer nofollow">@intangiblecoins</a>) reported on August 3. The latest activity moved approximately 388.9 <a href="https://x.com/search?q=%24BTC&amp;src=cashtag_click" rel="noopener noreferrer nofollow">$BTC</a> across 218 transactions, affecting 462 potential victim addresses within a matter of hours.<h2 id="a-firmware-flaw-at-the-root-of-the-attacks">A Firmware Flaw at the Root of the Attacks</h2>The attacks trace back to <cite>a vulnerability in a March 2021 Coldcard firmware release that enabled attackers to systematically drain Bitcoin from thousands of wallets by reproducing keys generated with weak software-based randomness.</cite> In a properly functioning hardware wallet, seed phrases are created through a dedicated random-number generator. <cite>Coldcard's firmware was meant to draw that number from a dedicated hardware randomness generator, but an internal build setting told it to skip that generator. Key generation then fell through to a basic software substitute seeded from the chip's serial number and its clock registers.</cite><cite>Because every Bitcoin private key is derived from that seed, attackers who can recreate it can derive the same wallet and sweep funds without ever touching the physical device.</cite><cite>Coinkite released patched firmware, but seeds already generated under vulnerable versions remain compromised and cannot be fixed by an update.</cite><cite>Security firms warn that more wallets could be hit because owners cannot reliably tell if their seeds were generated on vulnerable firmware.</cite><h2 id="scale-of-losses-and-ongoing-danger">Scale of Losses and Ongoing Danger</h2>Prior to the fourth wave, <cite>Galaxy Research had identified three waves of thefts in which 1,367 BTC, around $88.6 million, was drained across 4,585 addresses.</cite><cite>In the fourth wave alone, Thorn detailed that over a roughly two-and-a-half-hour window, 388.93 BTC moved through 218 transactions from 462 victim addresses to 216 newly created addresses.</cite><cite>Thorn noted that some of the transactions are still in the mempool, meaning affected users may still have a window to protect their funds. He suggested using Replace-By-Fee (RBF) to attach higher fees, which could potentially override the pending transactions.</cite><cite>Thorn described the sweeps as deliberate and likely AI-orchestrated, warning that every single-sig Coldcard address created after the March 2021 firmware flaw will eventually be drained.</cite><cite>The incident has become one of the largest attacks ever targeting Bitcoin self-custody through cryptographic key generation rather than malware, phishing, or exchange breaches.</cite><cite>Security experts say the hack highlights growing operational risks around self-custody as cyber threats evolve, and the incident may accelerate adoption of regulated custodians and spot Bitcoin ETFs.</cite>Anyone holding $BTC on a Coldcard-generated address who has not yet moved their funds is urged to do so immediately using a freshly generated seed on a separate, unaffected wallet.Sources: <a href="https://www.coindesk.com/tech/2026/08/02/bitcoin-cold-wallet-attack-spreads-to-4-500-addresses-as-losses-near-usd89-million" rel="noopener noreferrer nofollow">CoinDesk: Bitcoin cold-wallet attack spreads to 4,500 addresses as losses near $89 million</a> <a href="https://decrypt.co/374817/coldcard-bitcoin-exploit-88-million-attackers-draining-wallets" rel="noopener noreferrer nofollow">Decrypt: Coldcard Bitcoin Exploit Balloons to $88 Million as Attackers Keep Draining Wallets</a> <a href="https://www.coindesk.com/tech/2026/08/01/how-bitcoin-cold-wallets-lost-usd70-million-in-an-attack-that-never-touched-the-devices" rel="noopener noreferrer nofollow">CoinDesk: How Bitcoin cold wallets lost $70 million in an attack that never touched the devices</a>

Coldcard Bitcoin Attacks Grow As Losses Top 90M

Table of Contents

BSCN

Other articles published on Aug 3, 2026

Chainlink Reserve tops 5.2M LINK as the program nears its first birthday

Tether prints $1.5B profit in Q2 while cutting risk and stacking gold

XRP holders are pulling coins off exchanges at a pace not seen since 2021

Lummis goes after "Big Bank Beth" as the CLARITY Act fight turns personal

Asia FX Steady as Iran Talks Resume; Yen Rally Continues on Intervention Watch

A Closer Look at Avalanche's 2026 Fundamentals

Join our free newsletter for daily crypto updates!