Researchers confirm $111 million in stolen Bitcoin from Coldcard devices, with total losses potentially exceeding $130 million.
A security flaw in Coldcard hardware wallets has resulted in the theft of 1,719 BTC, valued at approximately $111 million. The exploit, confirmed by researchers, may push total losses beyond $130 million as additional cases are verified.
The attack involves over 25 distinct patterns, suggesting multiple threat actors are exploiting the vulnerability. More than 250 victims have reported losses, with potential total thefts reaching 2,300 BTC if all outstanding cases are confirmed. The bug appears isolated to Coldcard Mk3, Mk4, Mk5, and Q models.
No evidence indicates the flaw affects other signing devices or wallets beyond the identified Coldcard versions.