Coldcard Bitcoin exploit spreads to 4,500 addresses with losses near $89 million
Galaxy Research identifies third wave of sweeps targeting smaller balances as attacker changes onchain collection method
Briefing
- An attacker exploiting weak keys generated by Coldcard hardware wallets has now compromised 4,500 addresses, with total losses approaching $89 million across multiple waves.
- An earlier Galaxy Research analysis identified 1,196 addresses drained of 1,082.65 BTC in a 41-minute window, establishing the scale of a single sweep event before the third wave was detected.
- The third wave marks a tactical shift by the attacker, who is now targeting smaller balances and altering how funds are consolidated onchain, complicating tracing efforts.
- The expanding address count from roughly 1,200 to 4,500 indicates the underlying key-generation vulnerability affected a far broader set of Coldcard wallets than initially estimated.
- Hardware wallet users with keys generated by affected Coldcard firmware should treat their wallets as compromised and move funds immediately; the attacker has shown no sign of stopping.
Analysis
- Hardware wallet manufacturers face an immediate credibility crisis that accelerates migration toward software-based and multi-signature custody solutions. The expansion from 1,200 to 4,500 compromised addresses signals the vulnerability is systemic to Coldcard's key-generation firmware, not isolated incidents. Competing hardware wallet vendors (Trezor, Ledger) and institutional custody platforms benefit from forced user migration, while Coldcard's market share collapses regardless of whether a firmware patch is issued, as affected keys cannot be retroactively secured.
- The Coldcard exploit compounds existing crypto custody risk narrative established by the Apple fake Sparrow Wallet lawsuit ($1.8M drained) and the Zcash Orchard vulnerability ($1.7B gated), creating a multi-vector custody crisis that accelerates institutional demand for audited, insured custodians. Coinbase Custody and Anchorage are the direct beneficiaries as self-custody risk becomes demonstrably systemic. This dynamic reinforces the institutional custody moat at a moment when Morgan Stanley is expanding its ETP shelf.
- The attacker's shift to smaller balances and altered consolidation patterns in wave three materially complicates on-chain tracing and reduces the probability of fund recovery via exchange cooperation. Prior large-sweep events, where 1,082 BTC moved in 41 minutes, were traceable in structure; fragmented, smaller flows mimic organic activity and are harder for compliance teams to flag. Exchanges with real-time OFAC and stolen-funds screening face a higher false-negative rate, increasing the probability that some portion of the $89 million is laundered through legitimate venues.
Historical Context
- 2023
The Libbitcoin Explorer weak-key vulnerability (CVE-2023-39910) drained roughly $900,000 from wallets whose private keys were generated using insufficient entropy. The Coldcard case follows the same mechanism: flawed key generation rather than protocol compromise, meaning no amount of network-level security prevents the drain once keys are exposed.
- 2022
The Slope wallet exploit on Solana compromised approximately 9,000 wallets and drained roughly $8 million by exposing seed phrases through a logging vulnerability in the wallet software itself. That event established the precedent that hardware and software wallet firmware flaws, not smart contract bugs, represent the highest-severity custody attack vector.
- 2020
Ledger's customer data breach exposed 270,000 user records, triggering phishing and physical threats against hardware wallet holders. While that was a data leak rather than a key-generation flaw, it demonstrated that hardware wallet brand damage from security incidents is severe, persistent, and directly benefits competitors in the near term.
Connected Events
Apple sued over fake Sparrow Wallet app that drained $1.8M in Bitcoin
Apple is facing a lawsuit over a fake Sparrow Wallet app that drained $1.8 million in Bitcoin from three users, with allegations that Apple retained the fraudulent app after an $875,000 theft was reported. Combined with the Coldcard exploit, this establishes a multi-vector custody failure pattern spanning both hardware and app-distribution channels within the same news cycle.
Zcash Ironwood upgrade activates, retiring vulnerable Orchard shielded pool
Zcash's Ironwood upgrade activated to retire the Orchard shielded pool after a counterfeiting vulnerability went undetected for four years, gating $1.7 billion in assets. The Orchard and Coldcard incidents together signal a period of compounding infrastructure credibility failures across crypto, which systematically advantages institutional custodians over self-custody solutions.
BlackRock, Coinbase and Strategy form $15M consortium to quantum-proof Bitcoin
The BlackRock-Coinbase-Strategy $15M quantum-proofing consortium and Galaxy's $5M initiative both assume Bitcoin's cryptographic foundations remain intact at the protocol level. The Coldcard exploit is a reminder that the near-term attack surface sits at the key-generation and wallet-firmware layer, not the protocol layer, making the quantum research focus strategically misaligned with the current threat vector.
Further reading
See Indexa more often on Google
Mark Indexa as a preferred source — your Top Stories will surface more Indexa coverage.
