sam_dev 
A serious security incident involving the Coldcard hardware wallet line is causing significant concern in the cryptocurrency community as the total value of stolen Bitcoin has risen to approximately $70 million. According to the latest analysis from Galaxy Research, the attacker withdrew the entire balance from nearly 1,200 wallet addresses, indicating this could be one of the largest hardware wallet vulnerability exploits in recent times.
Data released by Galaxy Research shows that a total of 1,196 Bitcoin addresses were completely drained, with a total of 1,082.65 BTC, equivalent to about $70.2 million at market prices at the time of the incident. All transactions took place in just over 40 minutes, from 01:10 to 01:51 UTC on July 30, indicating the attack was meticulously prepared and executed in an almost fully automated manner.
Previously, hardware wallet manufacturer Coinkite issued an urgent warning about a vulnerability affecting seed phrases generated on Coldcard Mk3 devices. The company stated that any user who created a seed using Coldcard Mk3 running firmware version 4.0.1 released in March 2021 or later versions could face the risk of asset loss.
Soon after, Coinkite expanded the warning to include certain firmware versions of the Coldcard Mk4, Mk5, and Coldcard Q models after investigations revealed these product lines could also be affected under certain conditions. Simultaneously, the company released emergency firmware updates to patch the vulnerability across all affected devices.
Coinkite CEO Rodolfo Novak (NVK) officially apologized to users and admitted the company was fully responsible for the firmware error. He stated that the internal review process failed to detect the vulnerability before the software was released, leading to severe consequences for a segment of customers.
Notably, Novak suggested that the vulnerability might have been discovered with the help of artificial intelligence (AI). According to him, the rapid development of AI is creating a new reality in the field of cybersecurity, as AI-based source code analysis tools can detect potential errors significantly faster than traditional inspection methods by security experts. This means hackers can also leverage AI to find and exploit weaknesses in publicly available source code.
In their analysis report, Galaxy Research stated they traced the funds based on transaction patterns identified by Block engineers and security expert Clay Garrett. The results showed that all the stolen Bitcoin had similar characteristics, likely carried out by the same attacking entity.
However, Galaxy Research also noted that this transaction pattern only reflects how the funds were moved after the attack occurred and does not accurately represent the method of exploiting the vulnerability. On the blockchain, these withdrawal transactions are almost indistinguishable from the owner transferring Bitcoin to another address, making detection and investigation more challenging.
More worryingly, the research team warned that the nature of the vulnerability suggests similar attacks could continue to occur against Bitcoin addresses created from affected seeds, even if they did not appear in the recent withdrawals. This means some wallets not yet attacked may still face risks if users have not taken remedial measures.
After discovering the incident, Coinkite advised all affected users to immediately update to the latest firmware, create a completely new seed phrase, and transfer all assets to a new wallet. The company also recommended users test with a small-value transaction first to confirm the new wallet is functioning properly before transferring all Bitcoin. Additionally, the backup of the old wallet should be retained until the entire asset transfer process is successfully completed.
