TLDR:
- Galaxy Research links 1,367.05 BTC across 4,585 addresses to suspected thefts tied to Coldcard seeds.
- A third attack cluster added 207.7294 BTC, lifting estimated losses far above the first $38 million figure.
- The flaw weakened seed randomness, leaving wallets vulnerable despite air-gapped storage and offline backups.
- Firmware fixes protect new seeds, but users must migrate funds because updates cannot repair older weak seeds.
Losses linked to a Coldcard seed-generation flaw have risen to an estimated 1,367.05 Bitcoin, worth about $88.6 million. Galaxy Research reached the figure after identifying a third suspected theft cluster.
The estimate now covers 4,585 addresses, while attacker-controlled endpoints held 1,366.3865 BTC that remained unspent on-chain. Galaxy classified the activity as suspected hacks, so the total remains an on-chain estimate, not confirmed victim accounting.
Third Attack Cluster Pushes Estimated Losses to $88.6M
The newly identified attack wave involved 207.7294 BTC, extending an investigation that began with a smaller estimate. Early reports placed losses near 594 BTC, then worth $38 million, across about 500 wallets.
Galaxy later reconstructed a larger sweep involving 1,082.65 BTC from 1,196 addresses during a 41-minute window on July 30. Transactions crossed six blocks, indicating that vulnerable keys were likely identified before coordinated batches moved the funds.
The rising totals show why initial cryptocurrency theft figures often change as analysts connect new address clusters. Investigators must distinguish victim wallets, attacker destinations, and intermediate transfers while preventing the same funds from being counted twice.
That process becomes harder when funds remain stationary, as investigators cannot rely on later transfers to clarify ownership patterns. Even so, the unspent balances provide a visible record of the suspected theft’s scale.
The attack did not require physical access, malware, or a stolen recovery phrase. Instead, the weakness began when affected devices generated the secret controlling each wallet.
A 2021 software integration redirected seed creation to MicroPython’s deterministic fallback generator rather than the intended hardware random-number generator. That error sharply reduced the unpredictability protecting newly created wallets.
Older Mk2 and Mk3 units produced an estimated 40 bits of effective search space. Newer Mk4, Q, and Mk5 models reached about 72 bits instead of 128 bits.
Weak Seed Randomness Leaves Existing Wallets Exposed
Block’s engineering and security teams traced the weakness to the same firmware path. Their review found that device identifiers, timer states, and earlier generator calls could narrow candidate outputs.
An attacker could then reproduce possible seed streams offline and compare derived public addresses against visible blockchain records. This method exposed wallets despite air-gapped storage and offline backups.
Coinkite broadened the affected device scope on August 1 and released corrected firmware across every impacted product line. However, installing new software does not strengthen a seed created under defective randomness.
Affected users must create a new seed on fixed firmware, verify the backup and receiving address, and send a small test transaction. They should move the remaining balance only after confirming the test.
Seeds created with at least 50 fair, independent, private dice rolls are not considered exposed by this flaw alone. A strong BIP-39 passphrase adds protection, although migration remains recommended.
TAPSIGNER, OPENDIME, and SATSCARD remain unaffected because they use different codebases. Multisignature setups can reduce similar risks only when enough keys originate from independent, uncompromised sources.
The incident demonstrates that hardware isolation protects secrets after creation, but cannot repair weak randomness at the start. In this case, the wallet’s weakest point appeared before its first transaction.
