Galaxy Research: Coldcard Wallet Exploit Still Active; Impacted Address List to Be Updated

Odaily Planet Daily reports that Alex Thorn, Head of Galaxy Research, said on X that an ongoing exploit is targeting Coldcard single-signature wallets created with weak randomness. Users who still hold funds in affected wallets are urged to move them immediately to secure addresses. Galaxy Research is continuing to add newly identified victim and attacker addresses to its investigation database and will publish updated figures on the number of affected addresses. Thorn noted that the first, second, and third waves previously observed showed clear signs of automation, and the stolen BTC has remained parked in attacker-controlled addresses without being moved. More recently, smaller-scale actors have started taking advantage of the same weakness, stealing funds and then routing them through chain-stripping techniques and cross-chain services. Galaxy Research confirmed that all single-signature wallet addresses generated by Coldcard after the March 2021 firmware upgrade may be at risk, and users should migrate funds as soon as possible. Galaxy Research previously estimated the exploit involved about 1,367.05 BTC (around $88.6 million) across roughly 4,585 addresses.