Coldcard Cold‑Wallet Attack Spreads to 4,500 Addresses, Losses Near $89 Million

Galaxy Research identified a third wave of sweeps exploiting weak keys generated by Coldcard, now affecting 4,500 wallets and pushing losses toward $89 million.

A New Threat Wave in Cold‑Wallet Security

The research team revealed that attackers are leveraging low‑entropy seeds produced by Coldcard devices, using automated scanning scripts to compromise thousands of wallets in a single pass. Unlike the first two waves that focused on high‑balance accounts, this wave targets a broader address set, including smaller balances.

Evolution of the Adversary’s Playbook

While earlier campaigns zeroed in on large holdings, the latest iteration aggregates smaller balances and consolidates the stolen funds on‑chain, complicating traceability. A portion of the proceeds is being funneled through mixing services.

Market and User Reaction

■4,500 addresses compromised, average balance $19,800.

■Estimated losses $89 million, roughly 30% of prior waves.

■Coldcard users report a 12% rate of wallet re‑generation.

■Major exchanges Binance, Kraken, and Coinbase have upgraded real‑time monitoring tools.

Immediate Mitigation Blueprint

Experts urge cold‑wallet holders to adopt multi‑signature schemes, time‑locked withdrawals, and promptly apply firmware updates. Moreover, manufacturers like Coldcard should subject their randomness algorithms to regular independent audits.

Cem Talu: This incident underscores the need for cold‑wallet makers to reassess their entropy generation processes. Devices such as Coldcard must undergo frequent third‑party cryptographic reviews. Users should immediately implement layered defenses, including multisig and timelocks, to safeguard their assets.