coldcard

According to Bitcoin News monitoring, DART stated that it, along with independent white hat researchers, has recovered over 50 BTC from wallets affected by the COLDCARD entropy vulnerability, completing the transfer before malicious attackers could steal them. DART is a digital asset recovery organization that collaborates with white hat researchers to protect vulnerable funds and coordinates their legal return to the owners.The white hat researchers did not request a bounty and will return the Bitcoin to the owners. The recovered BTC has been transferred to the Crypto Recovery Trust. This trust is a dedicated statutory trust established under Wyoming state law to hold recovered digital assets and return them after confirming and verifying the legitimate owners.The trust will document the recovery process, separating the BTC from DART and the researchers' funds, conducting blockchain analysis, ownership verification, and sanctions screening, and providing a legal return process for verified owners. If there is a dispute over ownership, or if the related funds are involved in sanctions or criminal proceedings, the BTC will be handled according to applicable legal procedures. DART stated that other vulnerable assets and recovery leads are still under review.

According to Bitcoin News monitoring, Coldcard thieves are prioritizing the emptying of the largest portion of the third wave vaults. Galaxy Research indicates that these wallets have transferred out 97.09 BTC, worth approximately 7.7 million dollars, accounting for about 45% of the assets in this batch.The attackers created 293 2/2 vaults themselves, and had transferred some tokens through THORChain on September 2, subsequently moving them into multiple rounds of CoinJoin over the weekend. The vulnerability originated from a firmware flaw in 2021, which reduced the seed entropy to a minimum of 40 bits. Of the tokens stolen in this exploit, approximately 82% have not yet been transferred.

According to a report by Decrypt, Galaxy Research stated that the third wave of attackers on the Coldcard hardware wallet has recently transferred 97.09 BTC, worth approximately 7.7 million dollars at current prices, accounting for about 45% of the stolen Bitcoin in this wave.Among them, the attackers transferred about 20.5 BTC to Ethereum via THORChain cross-chain on September 2; subsequently, they moved some funds into the CoinJoin mixing process to increase the difficulty of tracking the funds. Currently, 11 of the 293 2-of-2 multi-signature addresses established by the attackers in the third wave have been emptied.The report indicated that this Coldcard security incident originated from a firmware vulnerability introduced in 2021, which significantly reduced the randomness of wallet mnemonic phrase generation, allowing attackers to potentially reconstruct private keys offline and steal funds. As of now, approximately 82% of the stolen BTC in the entire Coldcard attack incident has not yet been transferred.Galaxy Research believes that if the newly discovered suspected victim addresses are included in the statistics, the total amount of stolen BTC may reach about 1,806, worth approximately 144 million dollars.

Galaxy Research published that the attackers in the Coldcard "Wave 3" attack are still continuously transferring the stolen funds. During this phase, the attackers created 293 2-of-2 multi-signature wallets for each victim's assets. The first batch of funds was transferred across chains to Ethereum via THORChain; the latest round of transfers has begun entering the CoinJoin mixing process.Currently, the Wave 3 attackers are processing the largest amounts of stolen funds in order of the stolen amount, having sequentially transferred the funds from wallets ranked 1 to 11. The next 10 wallets that have not yet been transferred hold a total of 30.81 BTC, while wallets ranked 61 to 293 hold a total of 33.77 BTC. So far, the attackers have transferred about 45% of the stolen assets from this exploit, with funds flowing to Ethereum (via THORChain) or entering CoinJoin mixing transactions. Additionally, this fund transfer has revealed a previously unknown wallet: 58 addresses jointly spent in a 2-of-2 multi-signature format identical to that of Wave 3, and these were further transferred by the Wave 3 attackers to a jump address that funds CoinJoin.The on-chain analysis team currently marks this wallet as "cause = open," but believes it likely also belongs to Coldcard victims, which means the number of wallets involved in Wave 3 may increase to 294, raising the previously reported total amount stolen from the Coldcard vulnerability to approximately 1806 BTC. Currently, about 82% of the stolen BTC remains in addresses initially controlled by the attackers, while about 18% has been transferred, with the flow of funds indicating that it may be undergoing laundering processes.

Bitcoin News posted on the X platform that Coldcard is replenishing dealer inventory in batches as new devices are produced. About a month ago, Coldcard's entropy vulnerability led to the theft of over 100 million dollars worth of Bitcoin from users; the company stated that several dealers have applied for additional inventory, and the devices continue to sell.

According to Bitcoin News monitoring, hackers related to the third wave of theft incidents involving Coldcard wallets have begun to transfer the stolen funds for the first time, exchanging Bitcoin for ETH through THORChain. Alex Thorn from Galaxy Research stated that approximately 10% of the stolen BTC has been transferred, while the remaining 90% remains untouched.The attacker reportedly encountered difficulties when exchanging the funds, with multiple THORChain transactions being returned and retried. Researchers have traced the related exchange operations to a new Ethereum address, and Alex Thorn indicated that this address has been shared with relevant authorities and cryptocurrency companies. Galaxy Research noted that the broader Coldcard vulnerability exploitation incident has resulted in at least 8,865 addresses losing a total of 1,789 BTC, valued at approximately $115 million based on the price at the time of theft.

According to monitoring by Galaxy's research director, the COLDCARD Wave 3 attackers have transferred stolen funds for the first time and exchanged them for ETH through the THORChain cross-chain DEX. This is the first on-chain transfer of funds from the original hacker address in Waves 1, 2, or 3.

Blockstream stated that Jade is not affected by the Coldcard random number generator vulnerability and has released firmware 1.41 after receiving extensive AI-assisted security reviews. Jade indicated that it has undergone dozens of automated AI scans and multiple manual reviews, focusing on sensitive areas such as random number generation and transaction signing.The new firmware enhances stack protection, updates dependencies, audits sensitive memory cleanup processes, and upgrades the Jade runtime environment. Blockstream claims that Jade's random number generation mechanism uses multiple entropy sources, including hardware chip noise, timing data, sensor data, and camera noise, and mixes them using SHA-512 to prevent a single entropy source failure from affecting seed generation. The team stated that other lower-severity findings are still being addressed, and firmware 1.42 is expected to be released in a shorter development cycle.

According to monitoring by Galaxy's research director, Coldcard hackers are still active, and one hacker stole a key generated by increasing entropy through 5 dice rolls.

Coinkite's hardware wallet Coldcard has been exposed for a serious entropy vulnerability, which has gone undetected since 2021, resulting in over $100 million in Bitcoin being stolen, with victims mostly being users of single mnemonic wallets. The weak entropy allowed attackers to guess private keys through customized means, prompting the Bitcoin community to reassess the reliability of single-signature self-custody.Against this backdrop, multi-vendor multisig solutions are becoming the new custody baseline recommended by long-term holders. This solution requires users to construct multisig addresses using keys from different wallet vendors, such as Trezor Safe 7, Ledger Nano, and Casa recovery keys to form a 2-of-3 multisig, thereby reducing reliance on a single hardware vendor. Multisig can also defend against wrench attacks and has given rise to Bitcoin insurance services priced in BTC, such as AnchorWatch.However, multisig also has its drawbacks; users not only need to keep threshold keys but also need to save copies of the multisig script or template to independently recover funds when the wallet service is offline.

Bitcoin News posted on the X platform that BTC Sessions stated their team spent several weeks assisting Bitcoin holders affected by the Coldcard vulnerability in transferring their funds to safety, estimating that they protected Bitcoin worth tens of millions of dollars during this period. However, for many, it was too late.A member of the local Bitcoin community lost 90% of their Bitcoin, while another woman who spoke with them lost all of her Bitcoin. BTC Sessions stated that this could be the most severe self-custody incident in Bitcoin history. BTC Sessions indicated that this experience prompted them to rethink asset custody, with diversified security measures becoming a key lesson.

According to Cointelegraph, Galaxy Research has updated the tracking data of the Coldcard hardware wallet attack, confirming that 1,789.28 BTC (worth approximately $114.7 million at the time of the incident) was stolen from 8,865 addresses. Alex Thorn, head of Galaxy Research, stated that 87.3% (approximately 1,561 BTC) remains unspent in addresses controlled by the attackers, with all Bitcoin stolen in the first three waves of attacks still untouched.In subsequent attacks, some Bitcoin has been transferred through CoinJoin mixing transactions and small splits. The statistics are based on 221 victim reports, covering losses of 790.72 BTC, with a median loss of 1.04 BTC, and more than half of the reports involve losses exceeding 1 BTC. Galaxy has shared the attackers' addresses with exchanges, compliance companies, and law enforcement agencies, hoping that funds can be frozen when they flow into centralized intermediaries.

According to monitoring by Galaxy's research director, the Coldcard vulnerability incident involved 8,865 addresses, resulting in a total loss of 1,789.28 BTC, valued at $114.7 million at the time of theft, currently worth $138.8 million.By address statistics, the median loss per address was 0.00152 BTC, with an average of 0.20184 BTC; the median dormancy period was 3.2 years, with an average of 3.6 years. In 221 victim reports, the median loss was 1.04272 BTC, with an average of 3.57792 BTC; the median dormancy period was 3.25 years, with an average of 2.99 years. The losses reported by victims amounted to 790.72 BTC, accounting for 44.2% of the total loss. If medium-confidence losses are included, and the related losses have not yet been confirmed, the total loss will reach 1,824 BTC, valued at $140 million based on the price at the time of loss.

Bitcoin News posted on the X platform that Coinkite has released a new firmware update for Coldcard to fix the security issue with the mnemonic phrases.The previously vulnerable mnemonic phrases are still not safe and should be replaced.

Coldcard has released the latest firmware 5.6.1 (Mk4/Mk5) and 1.5.1Q (Q). This update is based on a three-week security review following an emergency fix, focusing on addressing the security risks posed by previous mnemonic phrase generation attacks. Each newly generated mnemonic phrase must include at least one user entropy source, such as irregular key presses at least 65 times, physical dice rolls 50 times, or physical coin tosses 128 times, combined with fresh entropy provided by STM32 TRNG, SE1, and SE2.The new firmware also adds pre-signing phased PSBT verification, strengthens USB connection and firmware update boundaries, improves Delta Mode isolation mechanisms, fixes active wallet backup issues, enhances random number generator initialization and fault checking, adjusts SIGHASH default settings, and includes multiple security and correctness improvements. Coldcard states that this update aims to further reduce the risk of the device being attacked.The official reminder is that updating the firmware cannot fix existing mnemonic phrases generated by previously affected firmware. If a user's mnemonic phrase falls within the scope of this security announcement, they should first update the device, then generate and verify a brand new mnemonic phrase, and migrate funds to the new wallet. Coldcard recommends that all Mk4, Mk5, and Q users update their devices promptly and verify the signatures of the downloaded firmware.

According to on-chain detective Specter, the victim claims to have transferred funds from Bitcoin to Ethereum due to a hack on Coldcard. However, on-chain data shows that 73 BTC (worth $4.6 million) originally came from the Whirlpool mixer two weeks ago, with some of it crossing over to Ethereum and subsequently deposited through a phishing Tornado Cash interface.Two mixers were used during the related fund transfer process. The individual was also found to be present in Telegram groups related to private key searches and brute force cracking. On-chain detective Specter indicates that the victim may be a threat actor, and their funds may have also been stolen by another threat actor.

According to Bitcoin Magazine, the investigation into the large-scale theft of Coldcard hardware wallets in July 2026 has made progress. Approximately 1,082.65 BTC (about $118 million) from the first wave of attacks remains in the attackers' addresses. The investigation found that the attackers used a paid account from a certain blockchain data service provider, and the internal logs "highly match" the theft pattern. Relevant clues have been handed over to law enforcement. Galaxy Research analyst Alex Thorn stated that the identity of the first wave of attackers "may have been grasped by law enforcement."Subsequent waves of attacks resulted in a total theft of about 2,000 BTC, with the second wave accounting for approximately 76 BTC. The operational pattern was similar to the first wave, possibly indicating the same perpetrator. The incident originated from an entropy generation vulnerability introduced in Coinkite's code update in March 2021, which caused some devices using MK2 and later models, with firmware version 4.1 and above, to generate low-strength private keys that could be brute-forced. Coinkite has released a fixed firmware and advised users to migrate their assets, but the scope of the vulnerability's impact is still being assessed.

A Bitcoin wallet created in 2012 transferred 212 Bitcoins after being dormant for 14 years, valued at 13.72 million dollars based on the price at the time of transfer. The wallet address was created on August 10, 2012. This batch of Bitcoins was initially worth 2,346 dollars, with a price of 11.07 dollars per coin; based on the price of 64,761 dollars mentioned, if sold entirely, the holder could realize a return of 584,725%. The identity of the wallet owner remains unknown.212 Bitcoins have been transferred from an old P2PKH wallet to an unmarked Bech32 wallet, and after being received in multiple batches, they are stored centrally. A Coldcard vulnerability led to nearly 2,000 Bitcoins being stolen, which may have prompted some long-term holders to transfer their assets, but this address has not been linked to any known entities.

According to the monitoring by the head of Galaxy Research, attacks targeting Coldcard are still ongoing. Users who continue to use Coldcard should remain vigilant and verify their device settings.They continue to assist victims and gather intelligence about the attackers, and they express hope that victims seeking help to track stolen funds can contact them via private message.