Coldcard Bitcoin Losses Soar to $88.6 Million Amid Firmware Vulnerability

Coldcard Suffers Major Losses as Vulnerabilities Exploited

On August 1, Galaxy Research updated its estimate regarding the losses connected to a Coldcard firmware flaw, now pegging the total at **1,367.05 BTC**, equivalent to approximately **$88.6 million**. This significant figure came as a result of losses across **4,585 addresses** associated with this security breach.

Details on the Losses

Galaxy’s analysis revealed that the initial wave of attacks occurred on **July 30**, draining **1,082.65 BTC** from **1,196 addresses** in a swift **41-minute** timeframe. Subsequent waves continued to exploit the vulnerability, with a second wave on **July 31** extracting **76.16 BTC** and a third wave reportedly draining **207.7294 BTC** from an additional **1,912 addresses**. Overall, the observed total across the three waves now amounts to **1,367.05 BTC**.

Transaction Patterns and Implications

Galaxy Research noted that the first two attack waves shared similar characteristics, including common collector addresses and destination types, suggesting they may have been executed by the same entity. However, the third wave exhibited different behavior, with funds moving to separate pay-to-witness-script-hash destinations. This evolving pattern poses complications for effectively tracking and estimating total losses.

Firmware Vulnerability Explained

The root of the issue lies in a series of firmware integration mistakes that impaired the functionality of the hardware random-number generator crucial for seed creation in affected Coldcard models, namely **Mk2 and Mk3** systems, which fall under firmware versions **4.0.1** through **4.1.9**. Although Coinkite, the maker of Coldcard, has issued hotfixes for affected devices, existing seeds still require migration to ensure future security.

Future Actions and Security Recommendations

Coinkite has urged users to install updated firmware, generate new seeds, and verify the integrity of their backups to mitigate risks. While seeds created with adequate entropy are not considered compromised, users should remain vigilant and follow best practices for passphrase security as additional protections.

Galaxy Research remains alert to potential updates in the estimated losses as new patterns or transactions emerge, emphasizing that the current figure of **$88.6 million** is merely the most recent assessment and not necessarily definitive. No immediate Bitcoin price fluctuations have been directly linked to this incident.