Coldcard Flaw Exploited by 15 Actors: $130 Million Loss and AI Security Warning

Galaxy Digital’s research chief Alex Thorn disclosed that a critical vulnerability in the Coldcard hardware wallet has been exploited by at least 15 independent attackers, resulting in Bitcoin losses estimated at $130 million.

Coldcard Vulnerability: Mapping the Attack Waves

Thorn’s latest report identifies three confirmed attack waves and a fourth wave still under investigation. The first wave siphoned 12 BTC across 126 addresses; the second wave moved 45 BTC, and the third wave took 73 BTC. The emerging fourth wave appears to involve 448 BTC, potentially pushing total losses to $130 million.

■15 distinct attackers identified

■12 BTC (first wave) – 126 addresses

■45 BTC (second wave)

■73 BTC (third wave)

■448 BTC (fourth wave, estimated)

AI’s $2 Hardening Solution

Dragonfly managing partner Haseeb Qureshi argued that the flaw could have been prevented with a mere $2 AI‑driven hardening. Public posts show that large language models like Claude regenerated the vulnerability in 8 minutes, while the open‑source model GLM 5.2 reproduced it in 20 minutes without internet access. This underscores AI’s capacity to slash discovery time dramatically.

Market and Investor Confidence Fallout

Coldcard’s 40‑bit private‑key entropy—far below the industry‑standard 128‑bit (12‑word seed)—stemmed from a firmware bug. Analysts warn that as AI‑driven discovery costs fall, similar flaws will surface more frequently, eroding trust in cold‑storage solutions and prompting institutions to reconsider self‑custody strategies.

Cem Talu – Blockchain researcher and crypto investor: “The rapid advancement of AI is outpacing traditional security testing. Cold‑wallet manufacturers must move beyond firmware patches and adopt AI‑powered stress testing and formal verification as a baseline. Otherwise, a $2 hardening cost will be dwarfed by multi‑million‑dollar losses.”