The Coldcard hardware wallet hack has exceeded $89 million with roughly 1,367 BTC stolen across 4,585 addresses in three distinct waves, and a potential fourth wave pushing total losses closer to $114 million. The attack exploits a firmware flaw from a March 2021 update that drew wallet seeds from a weak software fallback instead of the hardware random generator, reducing key security from 128 bits to approximately 40 bits. Galaxy Research has handed roughly 600 suspected attacker addresses to federal investigators and warns the exploit is ongoing. Coinkite, the Coldcard manufacturer, admits an attacker likely used AI to find the flaw in its open-source code.
Source: Read the original article
