A large-scale Bitcoin theft campaign tied to a vulnerability in older Coldcard hardware wallet firmware continues to spread, with total losses now approaching $89 million.
According to Galaxy Research, attackers have drained approximately 1,367 BTC from 4,585 wallet addresses across three separate waves of on-chain activity. The latest sweep suggests the operation is still active, although the average value stolen per wallet has fallen significantly compared to the initial attacks.
Third Wave Targets Smaller Bitcoin Holdings
Galaxy Research reported a third round of thefts early Sunday, during which roughly 208 BTC was removed from 1,912 addresses between Friday afternoon and Saturday morning UTC.
The latest phase differs noticeably from the first two attacks. Rather than consolidating stolen funds into a small number of collection wallets, the attacker sent each victim’s Bitcoin to separate destination addresses. The stolen funds were also placed into pay-to-witness-script-hash (P2WSH) outputs, a transaction format capable of supporting advanced spending conditions such as multisignature arrangements or timelocks.
Researchers observed that the third wave grouped an average of six victims into each sweep transaction, while the first wave processed victims individually. The attacker also limited scanning to the default derivation path commonly checked by wallets, instead of testing multiple address branches generated from a seed phrase.
These changes have made tracking the operation more difficult and raised questions about whether the same actor remains behind all three waves.
Galaxy said it is confident that each wave appears to be internally coordinated by a single operator but stopped short of definitively linking all three campaigns to the same entity. Researchers noted that blockchain data alone cannot determine whether the latest activity comes from the original attacker adapting tactics or from another actor exploiting the same vulnerability.
How the Coldcard Vulnerability Works
The attack traces back to a firmware issue introduced in March 2021 in Coldcard, the Bitcoin-only hardware wallet developed by Canadian company Coinkite.
The flaw caused affected devices to generate wallet seeds using a predictable software-based pseudorandom number generator (PRNG) rather than the hardware random number generator built into the device.
As a result, the pool of possible seed phrases became significantly smaller than intended. Attackers with sufficient computing resources can reproduce candidate seeds offline and compare derived wallet addresses against public blockchain records without ever accessing a victim’s device.
Galaxy Research first connected the exploit to a major theft on July 30, when an attacker emptied 1,196 Bitcoin addresses in just 41 minutes, stealing 1,082.65 BTC worth approximately $70.2 million at the time.
With the third wave included, total losses have climbed to approximately 1,367 BTC, valued at nearly $89 million based on current estimates.
Technical Analysis Reveals Weak Randomness Source
Cybersecurity researchers at Block traced the issue to a configuration error in Coldcard’s production firmware.
According to the company’s analysis, the affected firmware inadvertently relied on MicroPython’s Yasmarang fallback random number generator. This fallback mechanism was initialized using predictable inputs such as the device’s unique identifier and timer values and did not gather fresh entropy after startup.
The resulting seed phrases contained far less randomness than intended.
Coinkite estimates that affected Mk3 devices may have provided roughly 40 bits of effective entropy, while Mk4, Mk5 and Q models offered approximately 72 bits. By comparison, a standard 12-word BIP-39 seed phrase is designed to provide 128 bits of entropy.
Researchers cautioned that practical attack difficulty depends on several factors, including available device information, boot timing, previous random-number calls and address derivation costs.
Which Coldcard Devices Are Affected?
Exposure depends on the firmware version running when a wallet seed was originally created rather than the firmware currently installed.
The affected firmware ranges include:
Mk2 and Mk3
- Vulnerable versions generally include firmware releases between 4.0.0 and 4.1.9.
- The issue was fixed in version 4.2.0.
Mk4 and Mk5
- Firmware versions earlier than 5.6.0 are affected.
Coldcard Q
- Versions prior to 1.5.0Q are vulnerable.
Edge Releases
- Mk4 and Mk5 edge builds before 6.6.0X.
- Q edge builds before 6.6.0QX.
Coinkite Urges Users to Generate New Seeds
Coinkite released emergency firmware updates for affected devices on July 31. However, the company emphasized that updating firmware alone does not eliminate risk if a vulnerable seed phrase was previously generated.
Users are advised to create an entirely new seed using patched firmware and transfer funds to the newly generated wallet.
Simply restoring an old seed to an updated device or another wallet application does not resolve the underlying weakness because the compromised seed remains vulnerable.
The company noted that wallets created using at least 50 fair, independent and private dice rolls are not exposed to this specific issue. Users who are uncertain about how their seed was generated have been advised to migrate funds as a precaution.
Coinkite also said that a strong and unique BIP-39 passphrase provides an additional layer of protection because it creates a separate wallet inaccessible through seed words alone. Nevertheless, the company still recommends replacing potentially affected seeds.
Multisig Users May Have Additional Protection
Researchers noted that multisignature wallet setups can reduce risk, provided not all signing devices were created using vulnerable Coldcard firmware.
Coinkite added that several of its other products—including TAPSIGNER, OPENDIME and SATSCARD—use different codebases and are not impacted by the flaw.
Attack Emerges Amid Growing Focus on Weak Randomness Exploits
The identity of the attacker remains unknown.
Galaxy Research said it found no other Bitcoin transactions during the previous 30 days that matched the distinctive characteristics of the initial theft wave, including its unusual 30 sat/vB fee pattern and no-change transaction structure.
However, researchers warned that transaction patterns alone identify an operator’s behavior rather than proving theft, since similar transaction structures could theoretically be used by legitimate Bitcoin holders moving their own funds.
The incident follows the disclosure of Coinspect’s “Ill Bloom” research earlier in July. That separate weak-randomness vulnerability affected older software wallets and has been linked to more than $5 million in losses across Bitcoin, Ethereum, Tron, Rootstock and Polygon ecosystems since May.
As the Coldcard-related theft campaign enters its fourth day, the declining average value stolen per address suggests that many of the largest vulnerable wallets may already have been emptied. Nevertheless, ongoing sweeps indicate that attackers continue to search the remaining key space for additional exposed Bitcoin holdings.