Sophisticated Attack Campaign Drains Over $100 Million in Bitcoin from Coldcard Users
A coordinated series of three attack waves targeted Coldcard hardware wallets, resulting in the theft of more than $100 million in Bitcoin.
In one of the largest security incidents in the cryptocurrency hardware wallet space, a coordinated attack campaign has siphoned more than $100 million in Bitcoin from Coldcard users. The campaign, which unfolded over three distinct waves, exploited vulnerabilities that allowed attackers to bypass the device's security features. The findings, confirmed by blockchain analytics firm Galaxy, highlight the evolving sophistication of threats in the crypto ecosystem.
Anatomy of the Attack
According to the analysis, the first wave began in early 2024, targeting users who had downloaded fraudulent firmware updates. The second wave employed physical tampering techniques, while the third wave leveraged supply chain interception. Each wave was designed to extract private keys from the devices without leaving obvious traces. The attackers used a combination of social engineering, malware, and hardware manipulation to achieve their goals.
Key vulnerabilities exploited in the attack included:
- Unverified firmware updates delivered through compromised websites
- Physical modifications to the device's secure element during shipping
- Zero-day exploits in the wallet's random number generator
Galaxy's report notes that the attackers meticulously planned each wave, ensuring that the thefts went undetected for months. The scale of the losses underscores the risks even for users who rely on hardware wallets, often considered the gold standard for Bitcoin security.
Implications for the Industry
This incident serves as a stark reminder that hardware wallets are not immune to sophisticated attacks. Users are urged to source devices directly from manufacturers, verify firmware signatures, and regularly audit their transaction histories. The crypto community is now calling for stronger supply chain security and more rigorous testing of hardware wallet designs. As the investigation continues, Coldcard has released a security advisory detailing steps to mitigate future risks.
