Bitcoin cold-wallet attack spreads to 4,500 addresses as losses near $89 million
Galaxy Research flagged a third wave of sweeps tied to weak Coldcard-generated keys, with the attacker now targeting smaller balances and changing how funds are collected onchain.
YayaNews contributes financial news and market context through the YayaNews editorial workflow.
Bitcoin cold-wallet attack spreads to 4,500 addresses as losses near $89 million
Tech
Bitcoin cold-wallet attack spreads to 4,500 addresses as losses near $89 million
Galaxy Research flagged a third wave of sweeps tied to weak Coldcard-generated keys, with the attacker now targeting smaller balances and changing how funds are collected onchain.
By
Shaurya Malwa
Aug 1, 2026, 8:10 p.m.
2
min read
Make
preferred on
Share
Share this article
Copy link
X icon
X (Twitter)
Make
preferred on
Hacker facing screens with lines of code (Boitumelo/Unsplash)
Summary
Show
A vulnerability in a March 2021 Coldcard firmware release has enabled attackers to systematically drain bitcoin from thousands of wallets by reproducing keys generated with weak software-based randomness.
Three distinct waves of attacks have now swept 1,367 bitcoin—nearly $89 million at recent prices—from 4,585 addresses, with the latest wave targeting smaller balances and using more complex, harder-to-trace transaction patterns.
Galaxy Research believes each wave is the work of a single operator, but cannot determine whether the same attacker is behind all three, as the blockchain does not reveal whether separate sweeps are coordinated.
The attacker working through Coldcard-generated keys is now emptying wallets worth a few thousand dollars each.
Galaxy Research flagged a third wave of sweeps early Sunday, roughly 208 bitcoin drained from 1,912 addresses between Friday midday and Saturday morning UTC.
That is just over a tenth of a bitcoin per victim. The July 30 opening wave averaged close to a full coin, 1,083 bitcoin from 1,196 addresses in 41 minutes.
Observed losses across all three waves now total 1,367 bitcoin, nearly $89 million, from 4,585 addresses.
Wave three sends each victim’s coins to its own destination rather than the handful of shared collector addresses that made the first two easy to map, and parks them in pay-to-witness-script-hash outputs, a format that can carry multisignature or timelock conditions, instead of the plain single-key outputs used before.
It batched an average of six victims into each sweep where wave one took exactly one at a time, and it scanned only the default derivation path, the standard branch of the key tree a wallet checks first, instead of testing several branches per seed.
That is either the same operator rebuilding after being enumerated in public or a second one grinding the same vulnerable key space independently, and the chain does not distinguish them.
Galaxy said it is confident each wave is internally one operator, and will not link the three.
The flaw traces to a March 2021 firmware build that routed seed generation to a predictable software randomiser instead of the chip’s hardware one, leaving a bounded set of possible keys that anyone with the disclosure and enough compute can reproduce offline, without ever touching a device.
But the sweeping has not stopped almost three days later, and the falling average haul says the profitable end of that key space is already picked over.
Latest Crypto News
1
Tokenized stock trading surged 288% in July, but one QQQ token drove most of it
4 hours ago
2
Bank of Italy research suggests stablecoins aren't necessarily cheaper for remittances
5 hours ago
3
SEC to review Nasdaq bitcoin options approval after CME challenge
5 hours ago
4
Solana Foundation's new CISO warns AI is making crypto scams more convincing
8 hours ago
5
Everyone has the perps convergence backwards
8 hours ago
6
Binance founder CZ calls for wallet diversification after $70 million Coldcard exploit
12 hours ago
7
XRP Ledger upgrade brings back features once pulled over critical bugs
15 hours ago
8
How bitcoin cold wallets lost $70 million in an attack that never touched the devices
15 hours ago
9
Bitcoin holds monthly gain, faces 'choppy' August as 'forced-selling' exhausted, analysts say
Jul 31, 2026
10
Tether posts $1.5 billion operating profit in Q2 as reserve buffer falls by half
Jul 31, 2026
Latest Research
The Evolution of the Crypto CEX Landscape: A Case Study on Binance
The Evolution of the Crypto CEX Landscape: A Case Study on Binance
Binance remains crypto’s leading exchange, expanding from spot and derivatives into RWAs, payments, savings, yield, and broader financial services.
By
CoinDesk Research
Jun 29, 2026
Commissioned by
Binance
Binance remains crypto’s leading exchange, expanding from spot and derivatives into RWAs, payments, savings, yield, and broader financial services.
Why it matters
:
Binance remains crypto’s leading exchange, expanding from spot and derivatives into RWAs, payments, savings, yield, and broader financial services.
View Full Report
More From
Tech
Solana Foundation's new CISO warns AI is making crypto scams more convincing
XRP Ledger upgrade brings back features once pulled over critical bugs
How bitcoin cold wallets lost $70 million in an attack that never touched the devices
Crypto
CD20
$1,709.58
CD20 down 0.96 percent
0.96%
BTC
$62,730.54
BTC down 0.26 percent
0.26%
ETH
$1,842.53
ETH down 0.94 percent
0.94%
XRP
$1.06
XRP down 0.10 percent
0.10%
SOL
$71.69
SOL down 1.34 percent
1.34%
Original YayaNews editorial coverage, published for informational purposes.
This article is sourced from CoinDesk. It is for informational purposes only and does not constitute investment advice.
Topics & Symbols
Continue Reading
Related Reading
Strategy (MSTR) news: Michael Saylor and team maintain 12% dividend for STRC
Customarily, Michael Saylor and team have lifted the STRC dividend when it trades sizably below par, but not this month.
Minnesota Crypto ATM Ban Goes into Effect After Reported $1M Losses
Under a Minnesota law, crypto ATM operators had until Aug. 1 to deactivate any machines accessible to the public, but have until Dec. 31 to physically remove them.
Bank of Italy research suggests stablecoins aren't necessarily cheaper for remittances
A Bank of Italy study found stablecoin remittances aren't systematically cheaper than traditional money transfers, with fiat on- and off-ramps accounting for most of the cost.
Tokenized stock trading surged 288% in July, but one QQQ token drove most of it
Without that QQQ token, July volume for tokenized equities would be roughly $2.03 billion, about 30% below June’s total.
