On-chain analysis reveals three attack waves targeting Coldcard-generated Bitcoin addresses, resulting in $88.6 million in losses.
Three suspected attack waves have drained 1,367.05 BTC, valued at approximately $88.6 million, from addresses generated by Coldcard hardware wallets. The incidents involved 4,585 addresses, with the first two waves exhibiting similar transaction patterns, suggesting a single operator may be responsible.
The third attack differed significantly, potentially indicating either an evolved tactic by the same attacker or a separate entity exploiting the same vulnerability. The analysis relies solely on blockchain data, leaving the root cause—such as insufficient randomness in key generation—unconfirmed.
No immediate market reaction was reported, though the scale of the theft highlights risks in Bitcoin storage security.