Crypto news

A large-scale campaign targeting Coldcard hardware wallet users has resulted in losses of at least 1,778.84 BTC — approximately $112.7 million at the current exchange rate. According to my analysis of data gathered during the investigation, the peak of attacker activity occurred in late July to early August, with no new confirmed incidents recorded after August 6.

Attack Mechanics: Vulnerability in Entropy Generation

While working with 190 victims, I was able to confirm the theft of funds from more than 8,600 addresses. However, the true scale may be significantly higher: accounting for unconfirmed episodes, losses are estimated at 2,417.35 BTC, equivalent to roughly $153 million.

The root of the problem lies in an error made by Coinkite in 2021 during a firmware update. A change to the cryptographic entropy generation mechanism caused the random number generator to malfunction. Devices silently switched to an inferior entropy source, making private keys vulnerable to reproduction given sufficient computational power. In essence, the defect existed for years, but exploitation only became possible now.

Attacks Have Ceased, but the Threat Remains

Analysis of transaction chains shows that the last confirmed attack dates to August 6. The cessation is likely due to owners moving funds to new addresses or available assets being exhausted. Nevertheless, I strongly recommend that users of single-signature Coldcard wallets immediately move their bitcoins to new addresses.

It is important to note that the attackers were not acting alone. I discovered at least 33 separate traces of activity, indicating coordinated exploitation of the vulnerability by multiple groups.

The Fate of the Stolen Funds

Of the confirmed 1,778 BTC, approximately 1,531 BTC remain on the attackers' addresses. Roughly 246 BTC have already been moved, with 65% passing through CoinJoin transactions that complicate tracking. Another 35% moved via the Peel Chain scheme — a classic laundering method where small transactions are peeled off from a large sum. A small portion has been observed on centralized exchanges and cross-chain bridges; address lists have been provided to compliance services and law enforcement agencies.

A Blow to the Self-Custody Ideology

This incident is particularly painful because the victims are exemplary users: they did not use dubious exchanges or risky DeFi protocols, but trusted hardware wallets as the gold standard of security. As a result, we are witnessing panic: in the first four days after the attacks began, more than 22,000 BTC flowed into exchanges, and by August 8, the aggregate balance reached an all-time high of 3.683 million BTC.

Multisignature as a Solution and the Role of AI

Notably, no confirmed theft affected multisig addresses. Services like Casa and Anchorwatch report a sharp increase in clients, confirming that distributing risk across multiple keys is becoming the new norm. As Unchained co-founder Dhruv Bansal rightly notes, the problem is not custodial solutions, but the single point of failure — whether it be an exchange, a manufacturer, or the user themselves.

I would also like to highlight a troubling signal: some attackers likely used unrestricted AI models — in particular, Chinese open-source LLMs. This underscores that tools for finding vulnerabilities are becoming accessible not only to defenders but also to malicious actors. Against the backdrop of a record $1.1 billion in losses from hacks in the first half of 2026, this case serves as a stark reminder that even the most seemingly reliable solutions can harbor hidden defects.

My conclusion: the Coldcard incident is not merely a technical failure, but a systemic challenge to the entire industry. Relying on a single hardware wallet is no longer acceptable; the future lies in hybrid schemes with multisignature and regular code audits.