Galaxy Research: 1,367 Bitcoin stolen via three attack waves on Coldcard

Research by Galaxy Research has uncovered three suspected attack waves targeting Bitcoin addresses created with Coldcard hardware wallets. In total, 4,585 addresses were affected and 1,367.05 Bitcoin disappeared, amounting to approximately $88.6 million. The attacks were identified solely on the basis of blockchain data, and it has not yet been confirmed whether the affected addresses were actually created with insufficient randomness.

Bitcoin is available at OKX and Bybit.

In brief:

• Galaxy Research identified three attack waves in which 1,367 Bitcoin was stolen from Coldcard addresses.
• The first two waves are similar in transaction pattern; the third deviates significantly and may involve a different attacker.
• The stolen Bitcoin had remained dormant for an average of 3.18 years before the theft and is still held in the attackers’ addresses.

Three waves, possibly multiple attackers

The three attack waves differed considerably in scale and approach. The first wave took place on 30 July between 01:10 and 01:51 UTC and lasted just 41 minutes. During that time, 1,195 addresses were drained for a total of 1,082.65 Bitcoin, with an average loss of 0.906 Bitcoin per address. The second wave started a day later on 31 July and lasted over three hours and forty minutes. In that wave, 1,478 addresses together lost 76.16 Bitcoin.

The third and final wave ran from 31 July to 1 August and spanned nearly ten hours. In this case, 1,912 addresses were affected, accounting for 208.24 Bitcoin. Notably, the third wave used P2WSH address types and sent the coins directly to separate vault addresses, while the first two waves targeted P2WPKH addresses. Galaxy indicates that the first two waves are similar in transaction pattern and may have been carried out by the same party. Whether the third wave came from the same attacker or involves a new actor has not been established.

Stolen Bitcoin not yet moved

Alex Thorn, head of research at Galaxy Research, has indicated that the attacks are still ongoing. He is urging anyone who may hold a vulnerable Coldcard address to move their funds to a secure address as soon as possible. We previously reported on the Coldcard security breach in which 594 BTC was stolen, and on how Bitcoin sentiment reached a historic low following the news.

Remarkably, the stolen Bitcoin is still sitting in the attackers’ addresses. On average, the coins had remained unmoved on the affected addresses for 3.18 years, with a median period of 3.55 years, before they were siphoned off, suggesting that these were primarily long-term holders. At the current price of around $63.436, the stolen coins represent a substantial amount of value.