Galaxy Research confirmed the theft of 1,596 BTC from approximately 7,300 Coldcard addresses across three major waves and fourteen smaller incidents, resulting in known losses exceeding $100 million. A fourth wave under verification could bring the total to 2,055 BTC, worth nearly $130 million at current prices. According to Haseeb Qureshi of Dragonfly, an AI system was able to reproduce the vulnerability discovery for approximately $2 in computing costs, demonstrating how accessible this flaw had become. The vulnerability stemmed from a firmware modification in March 2021 where certain devices used a deterministic software generator instead of a hardware random number generator, reducing effective entropy to around 40 bits instead of the expected 128 bits. Galaxy reported that 90% of the stolen bitcoins have not yet moved and that roughly 600 suspicious addresses have been shared with US authorities and exchange platforms.
Source: Read the original article
