Bitcoin Cold-Wallet Attack Expands to 4,500 Addresses, Losses Near $89 Million
An advanced assault taking advantage of a flaw in Bitcoin cold wallets has resulted in the theft of nearly $89 million in BTC from over 4,500 different addresses. This operation specifically targets wallets utilizing the vulnerable COLDCARD firmware that was released in March 2021, enabling hackers to generate private keys from compromised recovery seeds. The attack commenced on July 30, with 1,083 BTC pilfered in just 41 minutes, followed by further incidents. Galaxy Research approximates total losses to be around 1,367 BTC. A firmware error led to predictable recovery seeds, compromising security. On August 3, a potential fourth wave was identified, featuring 218 questionable transactions. The event is influencing Bitcoin custody practices, prompting increased transfers and inflows to centralized exchanges. Users are urged to establish new wallets.
Key facts
- Nearly $89 million in Bitcoin stolen from over 4,500 wallet addresses.
- Attack exploits a firmware bug in COLDCARD wallets released in March 2021.
- Three confirmed attack waves, with a possible fourth wave detected on August 3.
- First wave on July 30: 1,083 BTC stolen from 1,196 addresses in 41 minutes.
- Total observed losses: approximately 1,367 BTC across 4,585 addresses.
- Galaxy Research estimates 207.7 BTC drained in the third wave.
- Stolen Bitcoin had remained untouched for an average of 3.18 years.
- Attacker switched to P2WSH outputs and separate destination addresses per victim.
- Possible fourth wave: 218 suspicious transactions involving 462 addresses.
- Galaxy narrowed fourth-wave dataset to 709 addresses holding 448.7 BTC.
- Replace-by-Fee (RBF) transactions may allow victims to recover funds.
- Centralized exchanges saw net inflows exceeding 15,000 BTC on August 1.
- Galaxy shared 600 suspected attacker addresses with U.S. investigators.
Entities
Institutions
- COLDCARD
- Galaxy Research
- Onchain Lens
- CryptoQuant
- Binance
- Kraken
- OKX
- River
- NFT Plazas