Coldcard losses reach US$100M across attacks
Share
- At least 15 attackers exploited a Coldcard vulnerability, according to Galaxy Digital research head Alex Thorn.
- Galaxy estimated confirmed Bitcoin (CRYPTO:BTC) losses at US$100 million, with a suspected fourth wave potentially lifting losses to US$130 million.
- Researchers are debating whether AI tools could help wallet developers identify similar software flaws before attackers exploit them.
At least 15 attackers exploited a Coldcard vulnerability, while Galaxy Digital estimated confirmed Bitcoin (CRYPTO:BTC) losses at US$100 million.
Galaxy identified three confirmed attack waves and a suspected fourth wave that could lift total losses to about US$130 million.
“Due to one single victim’s report of less than 1 BTC stolen, we identified a new attack,” said Galaxy research head Alex Thorn.
That newly identified attack siphoned 12 BTC from 126 addresses, showing how victim reports helped Galaxy identify previously unknown attackers.
Dragonfly managing partner Haseeb Qureshi said roughly US$2 of AI testing could have identified the vulnerability before the attack.
Tokenomist data lead Tatsapat Saerejittima questioned that claim, saying reported AI tests occurred after the vulnerability became public.
Castle Labs said the firmware bug reduced private-key entropy to 40 bits, compared with 128 bits for a standard 12-word seed.
At the time of reporting, Bitcoin price was $63,957.96.
