Bitcoin Cold-Wallet Attack Escalates, Affecting Thousands as Losses Mount

Bitcoin Cold-Wallet Attack Escalates

A third wave of a Bitcoin cold-wallet attack has resulted in significant financial losses, with nearly $89 million drained from approximately 4,500 addresses. Reported by Galaxy Research, the incident stems from vulnerabilities associated with Coldcard-generated keys that have been under scrutiny since a firmware issue in March 2021.

How the Attack Works

The exploitation involves leveraging weak software-based randomness that affects key generation, allowing malicious actors to systematically deplete bitcoin from compromised wallets. The latest sweep, which occurred between Friday midday and Saturday morning UTC, saw around 208 bitcoin removed from 1,912 addresses, averaging just over a tenth of a bitcoin per victim.

This third wave represents a shift in tactics, as attackers target smaller balances and utilize updated methods for collecting the stolen funds. Unlike earlier sweeps that used common collector addresses, this operation directs each victim’s coins to individual destinations, complicating tracking efforts.

Details of the Waves

Data reveal that the cumulative losses across all three attack waves amount to 1,367 bitcoin, with the first wave alone draining 1,083 bitcoin from 1,196 addresses within a swift 41 minutes. In contrast, the recent wave engaged an average of six victims per sweep, directly contrasting the earlier method of emptying one wallet at a time.

Ongoing Threat

As of now, the sweeping activity remains unabated after nearly three full days, indicating that the currently accessible portions of vulnerable key space may already be becoming scarce. Galaxy Research has expressed confidence that despite the evolving tactics, all three waves appear to be executed by a single actor, rather than multiple parties.

The Vulnerability Background

The root of this issue lies in a firmware version from March 2021 which improperly routed seed generation to a predictable software randomizer. This flaw left a limited set of potential keys that can be easily reproduced offline by anyone with knowledge of the vulnerability, without requiring direct access to the affected devices.