At Least 15 Attackers Exploited Coldcard Vulnerability, Galaxy Research Reports

At least 15 separate attackers have exploited the Coldcard vulnerability, according to Galaxy Digital's head of research, Alex Thorn, who cited fresh victim reports. One previously undiscovered attack siphoned 12 bitcoins from 126 addresses after a single victim reported losses of less than one bitcoin, prompting investigators to identify additional perpetrators with different exploitation methods.

Galaxy Research estimates total losses at $100 million across three confirmed attack waves, with a suspected fourth wave potentially bringing cumulative losses to approximately $130 million in bitcoin.

Securityanalysts have noted that minimal preventative measures might have stopped the exploit. Dragonfly managing partner Haseeb Qureshi suggested that roughly $2 worth of artificial intelligence-based hardening could have prevented it, citing reports that some AI models rediscovered the vulnerability in under 20 minutes. However, crypto analytics platform Tokenomist's data lead, Tatsapat Saerejittima, countered that AI models would unlikely have independently discovered this vulnerability before public disclosure. Castle Labs co-founder Francesco added that Coldcard's use of lower private key entropy—40 bits compared to the 128-bit standard in other wallets—may have contributed to the vulnerability.