Losses from the Coldcard firmware flaw have escalated significantly, with Galaxy Research now estimating that 1,367.05 BTC worth around $88.6 million have been siphoned off from compromised addresses. This figure reflects three distinct waves of attacks affecting 4,585 wallets, a sharp increase from the previously reported $70.2 million drained in the initial incident.

Tracing the Waves of Theft

The first attack wave struck within a rapid 41-minute window on July 30, sweeping 1,082.65 BTC from 1,196 addresses. Researchers pinpointed this activity between 01:10:20 and 01:51:26 UTC, identifying specific transaction characteristics such as uniform fees of 30 satoshis per virtual byte and the absence of change outputs. These markers enabled analysts to track the flow of stolen funds and differentiate this initial wave from subsequent ones.

The second wave, detected the following day, extracted 76.16 BTC from 1,478 addresses, while a third and larger surge drained 207.73 BTC from 1,912 addresses. Despite sharing some transaction and destination patterns, these waves exhibited distinct behaviors in their operations, suggesting varying methods or possibly different perpetrators behind the attacks.

Firmware Fixes and Lingering Vulnerabilities

Though Coinkite has released firmware updates aimed at securing new seed generations, the patches cannot retroactively protect seeds created under earlier flawed versions. This reality leaves a significant number of Coldcard users exposed, with compromised wallets continuing to be exploited. Galaxy Research notes the evolving nature of these attacks, warning that future thefts might employ different transaction patterns that could complicate tracking and estimation efforts.

These developments shows persistent risks in hardware wallet security. Earlier this year, similar security concerns surfaced in the broader crypto ecosystem, as highlighted in reports on large-scale scams and vulnerabilities. The Coldcard case stands as a stark reminder that firmware flaws, even when patched, can have lasting and financially devastating consequences for users.

This content is for informational purposes and does not constitute financial advice.