coldcard

Coldcard hardware wallet manufacturer Coinkite and its co-founders Rodolfo Novak and Peter D. Gray are facing a class-action lawsuit in Ontario, Canada. The lawsuit alleges that the standard firmware used by the Coldcard hardware wallet since around March 2021 has fundamental flaws, as it does not utilize a true random number generator but instead relies on a predictable software pseudo-random number generator, which could lead to the mnemonic phrases being reproduced and the Bitcoin held by users being at risk of unauthorized access.The lawsuit seeks class certification and claims that Coinkite violated the Consumer Protection Act and the Sale of Goods Act, while also involving allegations of negligence, breach of contract, and seeks damages.

Hardware wallet manufacturer COLDCARD stated that its official X account had previously posted a fake security announcement, directing users to a phishing website disguised as a wallet migration guide. The post has been deleted, but no corresponding login, session, or access records have been found.COLDCARD indicated that its credentials and offline two-factor authentication remain secure, leading to suspicions that the attacker may have gained X platform-level or administrative access, and has requested an urgent investigation by the X security team. The company also mentioned unverified reports of X administrator accounts being sold on the dark web, but no connection to this incident has been found.

According to monitoring by the head of Galaxy Research, the COLDCARD Seed Entropy theft incident has resulted in 1,830 BTC being stolen, involving three rounds of attacks and over 30 smaller related signs.A total of 256 victims have reported their situations to GLXY Research, with a median loss of 1.1 BTC, and the tracking of the attackers is still ongoing.

According to Bitcoin News monitoring, this batch of Bitcoin is worth over 4 million dollars, accounting for about 2.8% of the total Bitcoin related to the Coldcard vulnerability. Crypto Recovery Trust will verify the ownership of the funds and attempt to return them.Alex Thorn, head of research at Galaxy Digital, stated that another 3.0134 BTC was transferred to that address in the same transaction, but its source has not yet been confirmed.

White hat actors transferred 40.71 bitcoins related to the Coldcard vulnerability into a single transaction, valued at approximately 3.31 million dollars. This transaction aggregated funds from 11 addresses and included OP_RETURN information pointing to the Crypto Recovery Trust.Alex Thorn, head of Galaxy Research, revealed that a larger aggregation transferred a total of 52.37 bitcoins, involving multiple clusters of attacker addresses, accounting for about 2.8% of the funds involved in the vulnerability. A firmware flaw in Coldcard devices from March 2021 led to insufficient randomness in the mnemonic phrases, with the peak amount of funds involved being approximately 130 million dollars.

According to the monitoring by the head of Galaxy Research, the Coldcard white hat funds will come from the merger of 52.37 BTC from Wave 2, Footprints AA, AU, and AX into a new address, which recorded the OP_RETURN message "claim:cryptorecoverytrust dot com" in block number 967,948.These white hat funds account for 2.8% of the Coldcard vulnerability attack funds.

The firmware vulnerability of the hardware wallet Coldcard in 2021 led to insufficient randomness in some recovery seeds. Since July 30, attackers have transferred approximately 1,600 to 1,800 Bitcoins from affected wallets, involving thousands of addresses, with a valuation exceeding 100 million dollars. Coldcard manufacturer Coinkite stated that it must be assumed that someone is using AI to review its public firmware. This vulnerability has existed for about five years, and whether AI was involved in the related attacks has not been confirmed.Shielded Labs researcher Taylor Hornby used Claude Opus 4.8 audit agent to discover a vulnerability in the Zcash Orchard shielded pool circuit that began in 2022, which could generate an unlimited amount of counterfeit ZEC without detection during testing. Developers completed the fix within a few days, and no theft of coins has been confirmed.Blockchain analysis company Chainalysis statistics show that the on-chain write volume carrying malware instructions and command control information has increased from an average of about 2.06 times to 11.1 times daily, a growth of 440%.

According to Bitcoin News monitoring, DART stated that it, along with independent white hat researchers, has recovered over 50 BTC from wallets affected by the COLDCARD entropy vulnerability, completing the transfer before malicious attackers could steal them. DART is a digital asset recovery organization that collaborates with white hat researchers to protect vulnerable funds and coordinates their legal return to the owners.The white hat researchers did not request a bounty and will return the Bitcoin to the owners. The recovered BTC has been transferred to the Crypto Recovery Trust. This trust is a dedicated statutory trust established under Wyoming state law to hold recovered digital assets and return them after confirming and verifying the legitimate owners.The trust will document the recovery process, separating the BTC from DART and the researchers' funds, conducting blockchain analysis, ownership verification, and sanctions screening, and providing a legal return process for verified owners. If there is a dispute over ownership, or if the related funds are involved in sanctions or criminal proceedings, the BTC will be handled according to applicable legal procedures. DART stated that other vulnerable assets and recovery leads are still under review.

According to Bitcoin News monitoring, Coldcard thieves are prioritizing the emptying of the largest portion of the third wave vaults. Galaxy Research indicates that these wallets have transferred out 97.09 BTC, worth approximately 7.7 million dollars, accounting for about 45% of the assets in this batch.The attackers created 293 2/2 vaults themselves, and had transferred some tokens through THORChain on September 2, subsequently moving them into multiple rounds of CoinJoin over the weekend. The vulnerability originated from a firmware flaw in 2021, which reduced the seed entropy to a minimum of 40 bits. Of the tokens stolen in this exploit, approximately 82% have not yet been transferred.

According to a report by Decrypt, Galaxy Research stated that the third wave of attackers on the Coldcard hardware wallet has recently transferred 97.09 BTC, worth approximately 7.7 million dollars at current prices, accounting for about 45% of the stolen Bitcoin in this wave.Among them, the attackers transferred about 20.5 BTC to Ethereum via THORChain cross-chain on September 2; subsequently, they moved some funds into the CoinJoin mixing process to increase the difficulty of tracking the funds. Currently, 11 of the 293 2-of-2 multi-signature addresses established by the attackers in the third wave have been emptied.The report indicated that this Coldcard security incident originated from a firmware vulnerability introduced in 2021, which significantly reduced the randomness of wallet mnemonic phrase generation, allowing attackers to potentially reconstruct private keys offline and steal funds. As of now, approximately 82% of the stolen BTC in the entire Coldcard attack incident has not yet been transferred.Galaxy Research believes that if the newly discovered suspected victim addresses are included in the statistics, the total amount of stolen BTC may reach about 1,806, worth approximately 144 million dollars.

Galaxy Research published that the attackers in the Coldcard "Wave 3" attack are still continuously transferring the stolen funds. During this phase, the attackers created 293 2-of-2 multi-signature wallets for each victim's assets. The first batch of funds was transferred across chains to Ethereum via THORChain; the latest round of transfers has begun entering the CoinJoin mixing process.Currently, the Wave 3 attackers are processing the largest amounts of stolen funds in order of the stolen amount, having sequentially transferred the funds from wallets ranked 1 to 11. The next 10 wallets that have not yet been transferred hold a total of 30.81 BTC, while wallets ranked 61 to 293 hold a total of 33.77 BTC. So far, the attackers have transferred about 45% of the stolen assets from this exploit, with funds flowing to Ethereum (via THORChain) or entering CoinJoin mixing transactions. Additionally, this fund transfer has revealed a previously unknown wallet: 58 addresses jointly spent in a 2-of-2 multi-signature format identical to that of Wave 3, and these were further transferred by the Wave 3 attackers to a jump address that funds CoinJoin.The on-chain analysis team currently marks this wallet as "cause = open," but believes it likely also belongs to Coldcard victims, which means the number of wallets involved in Wave 3 may increase to 294, raising the previously reported total amount stolen from the Coldcard vulnerability to approximately 1806 BTC. Currently, about 82% of the stolen BTC remains in addresses initially controlled by the attackers, while about 18% has been transferred, with the flow of funds indicating that it may be undergoing laundering processes.

Bitcoin News posted on the X platform that Coldcard is replenishing dealer inventory in batches as new devices are produced. About a month ago, Coldcard's entropy vulnerability led to the theft of over 100 million dollars worth of Bitcoin from users; the company stated that several dealers have applied for additional inventory, and the devices continue to sell.

According to Bitcoin News monitoring, hackers related to the third wave of theft incidents involving Coldcard wallets have begun to transfer the stolen funds for the first time, exchanging Bitcoin for ETH through THORChain. Alex Thorn from Galaxy Research stated that approximately 10% of the stolen BTC has been transferred, while the remaining 90% remains untouched.The attacker reportedly encountered difficulties when exchanging the funds, with multiple THORChain transactions being returned and retried. Researchers have traced the related exchange operations to a new Ethereum address, and Alex Thorn indicated that this address has been shared with relevant authorities and cryptocurrency companies. Galaxy Research noted that the broader Coldcard vulnerability exploitation incident has resulted in at least 8,865 addresses losing a total of 1,789 BTC, valued at approximately $115 million based on the price at the time of theft.

According to monitoring by Galaxy's research director, the COLDCARD Wave 3 attackers have transferred stolen funds for the first time and exchanged them for ETH through the THORChain cross-chain DEX. This is the first on-chain transfer of funds from the original hacker address in Waves 1, 2, or 3.

Blockstream stated that Jade is not affected by the Coldcard random number generator vulnerability and has released firmware 1.41 after receiving extensive AI-assisted security reviews. Jade indicated that it has undergone dozens of automated AI scans and multiple manual reviews, focusing on sensitive areas such as random number generation and transaction signing.The new firmware enhances stack protection, updates dependencies, audits sensitive memory cleanup processes, and upgrades the Jade runtime environment. Blockstream claims that Jade's random number generation mechanism uses multiple entropy sources, including hardware chip noise, timing data, sensor data, and camera noise, and mixes them using SHA-512 to prevent a single entropy source failure from affecting seed generation. The team stated that other lower-severity findings are still being addressed, and firmware 1.42 is expected to be released in a shorter development cycle.

According to monitoring by Galaxy's research director, Coldcard hackers are still active, and one hacker stole a key generated by increasing entropy through 5 dice rolls.

Coinkite's hardware wallet Coldcard has been exposed for a serious entropy vulnerability, which has gone undetected since 2021, resulting in over $100 million in Bitcoin being stolen, with victims mostly being users of single mnemonic wallets. The weak entropy allowed attackers to guess private keys through customized means, prompting the Bitcoin community to reassess the reliability of single-signature self-custody.Against this backdrop, multi-vendor multisig solutions are becoming the new custody baseline recommended by long-term holders. This solution requires users to construct multisig addresses using keys from different wallet vendors, such as Trezor Safe 7, Ledger Nano, and Casa recovery keys to form a 2-of-3 multisig, thereby reducing reliance on a single hardware vendor. Multisig can also defend against wrench attacks and has given rise to Bitcoin insurance services priced in BTC, such as AnchorWatch.However, multisig also has its drawbacks; users not only need to keep threshold keys but also need to save copies of the multisig script or template to independently recover funds when the wallet service is offline.

Bitcoin News posted on the X platform that BTC Sessions stated their team spent several weeks assisting Bitcoin holders affected by the Coldcard vulnerability in transferring their funds to safety, estimating that they protected Bitcoin worth tens of millions of dollars during this period. However, for many, it was too late.A member of the local Bitcoin community lost 90% of their Bitcoin, while another woman who spoke with them lost all of her Bitcoin. BTC Sessions stated that this could be the most severe self-custody incident in Bitcoin history. BTC Sessions indicated that this experience prompted them to rethink asset custody, with diversified security measures becoming a key lesson.

According to Cointelegraph, Galaxy Research has updated the tracking data of the Coldcard hardware wallet attack, confirming that 1,789.28 BTC (worth approximately $114.7 million at the time of the incident) was stolen from 8,865 addresses. Alex Thorn, head of Galaxy Research, stated that 87.3% (approximately 1,561 BTC) remains unspent in addresses controlled by the attackers, with all Bitcoin stolen in the first three waves of attacks still untouched.In subsequent attacks, some Bitcoin has been transferred through CoinJoin mixing transactions and small splits. The statistics are based on 221 victim reports, covering losses of 790.72 BTC, with a median loss of 1.04 BTC, and more than half of the reports involve losses exceeding 1 BTC. Galaxy has shared the attackers' addresses with exchanges, compliance companies, and law enforcement agencies, hoping that funds can be frozen when they flow into centralized intermediaries.