Coldcard hardware wallet exploit could result in $130 million in Bitcoin losses across multiple waves of attacks, Galaxy Research reports.
Security & Exploits ·
A Coldcard hardware wallet exploit has resulted in Bitcoin losses that could reach $130 million, according to research from Galaxy, which estimates the figure will grow once a fourth wave of attacks is confirmed. The company flagged the possibility of additional losses beyond currently documented incidents affecting users of the widely-used air-gapped device.
The exploit targets a vulnerability in how Coldcard secures private keys, raising questions about the security assumptions surrounding devices marketed as isolated from internet threats. The air-gapped design is intended to protect against online compromise, yet the attacks have demonstrated a pathway to extract funds across multiple waves.
The full scope of the vulnerability remains incompletely mapped. Galaxy's estimate hinges on confirmation of a fourth attack wave, leaving uncertainty about the true scale of exposure and whether additional victims or attack vectors may emerge as the situation develops.