Bitcoin's $88M ColdCard Hack Isn't Over: Experts Warn All Vulnerable Wallets Will Eventually Be Drained

Researchers say the cryptocurrency theft targeting compromised Coldcard hardware wallets is still unfolding, warning that more users could risk losing their funds if they fail to act. Galaxy Research has uncovered a third wave of thefts, adding 207.73 Bitcoin (BTC) to the losses already recorded. The firm has now tracked about 1,367 BTC, worth roughly $88.6M at current prices, stolen from 4,585 wallet addresses.

Galaxy has shared a list of some 600 suspected attacker addresses with US federal investigators, compliance firms, and cybersecurity partners. The firm also credited affected users who supplied transaction records that helped investigators trace the stolen Bitcoin.

Attackers Are Still Targeting Vulnerable Wallets

According to Galaxy Research Head of Research Alex Thorn, investigators are continuing to identify new victims and attacker-controlled wallet addresses. 'I continue to investigate and add new Coldcard victim and attacker addresses to our investigation database,' Thorn wrote on X. 'The attack is ongoing—move your funds off Coldcard-generated addresses immediately if you have not done so.'

Thorn later warned that a likely fourth wave of the coordinated Coldcard attack was underway, urging users to check vulnerable wallets immediately. He added that some may still be able to use Replace-by-Fee (RBF) to move their Bitcoin before malicious transactions are confirmed.

The warning comes as researchers believe the attackers haven't finished exploiting compromised wallets. Thorn warned that every single-signature Coldcard address generated with the affected firmware should be regarded as compromised. 'It's only a matter of time,' he said, cautioning that any funds left in vulnerable wallets will eventually be emptied if users fail to move their funds.

Old Firmware Flaw Opened the Door

The vulnerability traces back to firmware changes introduced in March 2021 that weakened seed generation on affected Coldcard devices. As Decrypt previously reported, the flawed firmware generated recovery seed phrases with far less randomness than intended. As a result, the private keys securing users' Bitcoin are far easier to predict.

Researchers believe the attackers reconstructed the weakened private keys before sweeping funds from vulnerable wallets. Thorn calls the campaign highly organised and automated. He suggested the attackers may be using automation, potentially including large language models, to help scale the campaign.

Dormant Bitcoin Became the Main Target

One of the key findings of Galaxy's investigation was that most of the stolen Bitcoin had been dormant for years before disappearing, suggesting that long-term investors were among the hardest-hit victims.

As of Galaxy Research's latest investigation, the attackers had not moved the stolen funds beyond the receiving addresses linked to the three documented theft waves. That inactivity has allowed investigators to trace the blockchain and expand their list of suspected attacker wallets.

Panic Grows as Users Race to Protect Their Bitcoin

Coldcard users have been rapidly moving their Bitcoin to safer wallets in response to the ongoing exploit. Others have temporarily transferred their Bitcoin to exchanges such as Coinbase and Binance despite the crypto mantra, 'not your keys, not your coins.'

For some investors, the warning came too late. Canadian entrepreneur Jonathan Goodman said that he lost 18.25 BTC, worth around CA$1.6M, in just seven minutes, even though his recovery keys had been stored offline in a safety deposit box. 'Perhaps the hardest part about this is that I did everything right,' Goodman wrote on X. He said he has since reported the theft to law enforcement and the Ontario Securities Commission.

The investigation remains ongoing. Researchers warn that anyone who created a single-signature Coldcard wallet with the flawed 2021 firmware should act immediately. As attackers continue to target vulnerable addresses, experts believe the thefts are likely to continue until all vulnerable wallets have either been emptied or their owners move the funds elsewhere.