A firmware bug in Coinkite's Coldcard hardware wallets, disclosed July 30, has let attackers drain 1,367.05 BTC, worth about $89 million, from thousands of addresses. The resulting rush to move funds has driven the largest surge in small-holder Bitcoin transactions since the FTX collapse, while a separate wave of old-coin movement has further blurred on-chain signals. Coinkite also faces criticism over how it stored customer data used to warn victims.
Three attack waves drain Coldcard wallets
Coinkite's Coldcard hardware wallets have lost 1,367.05 BTC, worth about $89 million, to attackers exploiting a firmware bug that produced seed phrases with far too little randomness. Galaxy Research says the theft spans three suspected waves that hit 4,585 addresses since Coinkite first warned users. A third wave alone drained 207.73 BTC, pushing Decrypt's running tally to about $88.6 million.
Fixed firmware is now available, but existing affected seed phrases cannot be repaired through an update. Alex Thorn, Galaxy Digital's head of firmwide research, said the bitcoin from the three documented waves remains untouched in attacker-controlled addresses.
Thorn warned that every single-sig Coldcard address created after the 2021 firmware flaw will eventually be drained: "move your funds off Coldcard-generated addresses immediately if you have not done so." He also noted the stolen coins had sat dormant for an average of 3.18 years before being swept.
Migrations distort Bitcoin's on-chain signals
The rush to move funds before attackers reach them has produced the largest surge in small-holder activity since Bitcoin's post-FTX period. CryptoQuant's Julio Moreno said transactions under 1 BTC reached 39,600 BTC on July 31, the largest daily total for that cohort since November 2022, when 39,900 BTC moved after the FTX collapse. Daily active addresses jumped from about 645,000 to nearly 1 million over the same span, the highest level since Dec. 10, 2024.
Exchange deposits under 10 BTC climbed to 7,300 BTC, their highest since Feb. 6. Analyst JA Maartunn tracked 77,402 BTC moving out of older unspent-transaction-output bands, saying the issue may cause old coins to move as users secure their savings. Even so, market sentiment turned: Santiment found Bitcoin's ratio of bullish to bearish commentary fell to 0.58 positive comments per negative one, its lowest level since the firm began modern social tracking.
AI guardrails slow the hunt for stolen funds
Thorn told CryptoSlate that guardrails built into US large language models hindered efforts to track the stolen assets, forcing investigators to turn to an open-source Chinese model instead. Galaxy Research has reported about 600 suspected attacker addresses to law enforcement, compliance firms and other cyber investigators.
Coinkite faces backlash over stored customer emails
Coinkite separately drew backlash for emailing security warnings to customers whose purchases date back to 2019, reviving complaints it retains data it once said it deleted. CEO Rodolfo Novak maintained Coinkite does not store customer information, even though the company said it lacks a deletion schedule for the addresses it keeps for logins. Coinkite said it had emailed every address it could reach through its store and newsletter systems since Friday.
Sources: CryptoSlate, Decrypt, Bitcoin News
Trading involves risk.
Risk Disclaimer
