Coldcard Wallet Exploit Tops 1,800 BTC in Losses; FBI May Have Identified Initial Attacker
AI Market Summary
A Coldcard firmware random-number-generation flaw led to weak key entropy, enabling brute-force thefts now totaling over 1,800 BTC across 5,000+ addresses. New evidence suggests attackers used a paid blockchain data service account, with log patterns reportedly aligning to the attack sequence, implying potential law-enforcement attribution. Although ~1,082.65 BTC is reportedly frozen, the incident elevates hardware-wallet and supply-chain risk, pressuring near-term crypto security sentiment.
Impact level
● High
Affected assets
BTC/USDT+0.38%
AI Insight · BTC/USDTAI Insight
▼ Bearish
Trade now
⚠️ AI-generated insights are based on news content and are provided for informational purposes only. They do not constitute investment advice or represent the views of BingX. Investing involves risk. Please trade responsibly.
ME News reported that on Aug. 19 (UTC+8), investigators disclosed new findings in the July 2026 Coldcard hardware wallet theft case. Block's Bitkey team said the first attackers used a paid account at a well-known blockchain data provider to look up the compromised addresses. Internal logs from the platform reportedly match the attack's request volume, timing and execution sequence, raising the possibility that law enforcement already has leads on the perpetrators.
Galaxy Research previously estimated the initial wave moved 1,082.65 BTC, which remains frozen at the attackers' addresses. Total losses linked to the Coldcard firmware vulnerability have now surpassed 1,800 BTC, impacting more than 5,000 addresses.
Investigators traced the breach to a random number generation flaw in certain Coldcard firmware versions, which produced private keys with insufficient entropy and enabled attackers to brute-force access. Coldcard has released a patch and is urging potentially affected users to migrate funds immediately. (Source: BlockBeats)
