Bitcoin Holders Lose $88.6 Million in Coldcard Wallet Exploit

Bitcoin investors have lost approximately 88.6 million dollars due to a firmware bug in Coldcard hardware wallets. Researchers discovered that a flaw reduced the randomness used to generate recovery phrases, making it easier for attackers to compromise user funds. The issue stems from specific firmware versions released after March 2021.

Data shows that over 1,300 Bitcoin have been drained across thousands of individual addresses. The theft has occurred in three distinct waves, with the latest wave showing more sophisticated methods to avoid detection. While earlier attacks used simple patterns, the most recent activity suggests the attacker may have upgraded their tools to mask the movement of stolen funds.

Most of the victims appear to be individual holders rather than large institutions. Researchers identified these losses by analyzing on chain patterns and public reports, though they caution that the data relies on observed behavior rather than direct confirmation of the faulty key generation for every single account.

Coldcard users should remain cautious and monitor the situation for any official guidance on firmware updates. This event highlights the risks inherent in hardware security when underlying software processes fail to maintain true randomness. Experts suggest that anyone using older firmware versions should prioritize securing their assets.