Bitcoin cold-wallet attack spreads to 4,500 addresses as losses near $89 million
Galaxy Research flagged a third wave of sweeps tied to weak Coldcard-generated keys, with the attacker now targeting smaller balances and changing how funds are collected onchain.
A sophisticated attacker is targeting Bitcoin cold-wallets, draining wallets worth a few thousand dollars each, according to Galaxy Research. The breach began on July 30, with waves of theft occurring over three days, culminating in near-$89 million in losses from 4,585 addresses. The latest wave, observed on Sunday, drained 1,367 bitcoin from 4,500 addresses.
Unlike previous waves, this one dispersed coins to individual destinations, rather than a few shared collector addresses. The attack exploits a flaw in a March 2021 firmware build that used a predictable software randomizer for seed generation instead of a hardware one. This vulnerability leaves a limited set of potential keys, which an attacker could reproduce offline.
While Galaxy Research believes each wave is from the same operator, they cannot definitively link the three. The attacker has seemingly exhausted the profitable range of keys, as the average haul per victim has fallen over time. Despite the ongoing attack, it appears to have subsided after nearly three days.
Written by urgent.news from CoinDesk's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
