The Coldcard vulnerability has endured four waves of exploits so far, draining idle wallets. Long-term holders who did not move their coins are still vulnerable. The Coldcard exploiter has been active again, moving funds to a growing list of destination wallets.
As Cryptopolitan reported, the initial attack against 500 wallets was not the only exploit, and losses quickly climbed to over $70M. As of August 3, holders of several versions of the Coinkite wallets are still at risk, and the only solution is to move their coins as soon as possible to new, safely derived wallets. Coldcard wallets appealed to Bitcoin maximalists and were widely recommended. Recently, white hat hackers have shown that even a few minutes of AI compute can discover vulnerable addresses. Before the fourth wave, the estimated losses affected 1,196 addresses for a total of 1,086.65 BTC, according to Galaxy Research data.
Researchers identify patterns of the fourth wave of Coldcard exploit
On-chain researchers analyzing Coldcard addresses and BTC transactions have identified the pattern of a fourth wave of exploits. As of August 3, the attacker kept adding new destination wallets. After the wave was completed, the addresses sat idle for a few hours. According to Alex Thorn of Firmwide Research, the fourth wave most probably contains attempted attacks at multisig wallets, unlike the first three waves of transfers.
An estimated 857 addresses were attacked, losing 486.11 BTC. The attacker launched multiple destination wallets, using new addresses to sweep Coldcard users, then consolidate the gains into larger wallets. Losses are being reported by multiple influencers. The problem with Coldcard is that it has often been used for cold storage and is not easily accessible to move the coins and update. Some Coldcard private keys were also stored on metal plaques, but this did not prevent the attacker from sweeping those wallets.
The attacker apparently uses time-consuming computation, which exposes more batches of vulnerable wallets. This may delay the sweeping of new addresses, but the vulnerability still exists, and the fourth wave may not be the last. For years, the BTC narrative was that self-custody was the ideal solution. Exchange hacks, frozen funds, and lack of anonymity were the main arguments for taking coins off exchanges. BTC has been lost to compromised wallets before, but a mass vulnerability for a device is unprecedented.
Further analysis of the Coldcard codebase showed the platform deliberately edited 2,500 lines of code with minimal comments, introducing weak entropy in wallet creation, noted Bitcoin maximalist @hodlonaut. Reportedly, the more complex entropy function was disabled to make the code run without problems, thus potentially exposing thousands of wallets to being easily discovered.
The Coldcard incident has also raised vigilance on potentially weak seeds, which can now be discovered with the help of rented computation. Trader Jameson Lopp recalled other widely used wallets that reported flawed entropy bugs and patched them before the potential exploits. However, weakly derived addresses for cold storage remain a risk for new AI-powered attacks.
