Morning Minute: The Coldcard Bitcoin Hack Nears $114 Million in Potential Losses

The Coldcard Bitcoin hardware wallet exploit has surpassed $89 million in losses, with Galaxy Research tracking roughly 1,367 BTC stolen across 4,585 addresses and warning that a potential fourth wave could push damages near $114 million. The attack exploits a March 2021 firmware update that reduced key security to about 40 bits, allowing attackers to regenerate private keys without physical access. Coinkite, Coldcard's maker, suspects AI was used to find the flaw, and Galaxy's head of research Alex Thorn said the sweeps were 'probably orchestrated with a large language model.'

Morning Minute is a daily newsletter written by Tyler Warner https://twitter.com/Tyler Did It . The analysis and opinions expressed are his own and do not necessarily reflect those of Decrypt. GM Today’s top news: - Crypto majors continue slide despite oil falling; BTC at $62.6k - Coldcard hack passes $89M in losses - BitGo CEO challenges Anthropic to hack a BTC wallet holding 100 BTC - Tether Q2 profits jumped 50% to $1.5B - CATE soars to $50M and StonkBrokers reach 6.9 ETH, leading onchain action 🚩 The Coldcard Hack Passed $89 Million Before Fourth Wave Coldcard is one of the most trusted hardware wallets https://decrypt.co/19326/best-cryptocurrency-hardware-wallets in Bitcoin /?post type=post&p=5736 , the kind of air-gapped, offline device serious holders use to keep coins in deep cold storage. Last week, it became the center of one of the largest self-custody thefts ever. Attackers began systematically draining Bitcoin from Coldcard wallets, exploiting a flaw that let them regenerate users’ private keys without ever touching the physical device. The cause is a firmware flaw, not phishing. A March 2021 Coldcard update drew wallet seeds from a weak software fallback instead of the hardware random generator, collapsing an Mk3’s key security to about 40 bits from the intended 128. That made the keys guessable, which is why coins that sat untouched for years are being swept from wallets that never connected to the internet. One Canadian victim lost 18.25 BTC from keys kept in a safety deposit box, writing that the hardest part was that he “did everything right.” The theft grew all weekend. What started Thursday as an estimated $38 million drain https://decrypt.co/374766/38m-in-bitcoin-drained-by-coldcard-key-flaw-its-maker-thinks-ai-found kept climbing as researchers traced more of it. Galaxy Research now tracks roughly 1,367 BTC stolen, about $88.6 million https://decrypt.co/374817/coldcard-bitcoin-exploit-88-million-attackers-draining-wallets , across 4,585 addresses in three distinct waves, and flagged the newest wave Saturday. Galaxy is warning that the exploit is ongoing and that every vulnerable device will eventually be emptied, and it has handed roughly 600 suspected attacker addresses to federal investigators. A potential 4th wave of attacks has the damage nearing $114M https://decrypt.co/374820/coldcard-losses-near-114m-as-small-bitcoin-transfers-spike though researchers say some of the latest attacks may be avoidable by front-running the transaction settlements in the mempool. Coinkite, Coldcard’s maker, said it has to assume an attacker used AI to comb its open-source firmware for the flaw, and admitted its own AI review of the same code weeks earlier “did not find this bug or anything serious.” Galaxy’s head of research Alex Thorn said the sweeps look programmatic and were “probably orchestrated with a large language model.” Defenders and attackers had the identical tool, and this time it only worked for the attacker. In barely a week, an AI model cracked a post-quantum cryptography candidate humans couldn’t break, OpenAI’s models escaped a sandbox to breach other companies’ servers, and now attackers have used AI to drain $89 million from wallets sold as the gold standard of self-custody. AI is quickly becoming crypto’s biggest enemy. And one of crypto’s fundamental pillars, self-storage which makes one sovereign and in control of their wealth, is not under serious attack. 🌎 Macro Crypto and Markets Crypto majors are slightly red; BTC -1% at $62.6k; ETH -1% at $1,840; SOL -1% at $72.30; HYPE +3% at $52.90 Top alt movers include ALGO +7% , HYPE +3% and ENA +4% Oil -6% at $79.50; Gold even at $4,100 Stock futures are green on new Iran peace potential; DOW +1%, Nasdaq +0.35% Solana printed its 10th straight red monthly candle https://x.com/DegenerateNews/status/2083398205249573034 on July 31 BitGo CEO Mike Belshe publicly challenged Anthropic to hack a real wallet https://x.com/mikebelshe , telling the AI lab to stop with the "we created a hacking monster" demos and posting a BitGo address holding 100 BTC for its models to try to drain Tether reported $1.5 billion in Q2 net operating profit https://decrypt.co/374796/tether-reports-1-5b-q2-profit-usdt-supply-grows , up nearly 50% from Q1, with USDT circulation reaching $184.6 billion, a reserve surplus above $4 billion, and gold holdings rising to more than 146 metric tons Eric Trump’s American Bitcoin reported a $57.2M loss https://x.com/WuBlockchain/status/2084229836415943051 in Q2 while its Bitcoin holdings reached 8,002 Circle landed a New York trust charter https://decrypt.co/374791/circle-new-york-trust-charter-stablecoin-issuer from the NYDFS, letting the USDC issuer operate a New York trust company offering digital-asset custody, its second license in weeks after its federal national trust bank approval South Korea’s second-largest crypto exchange, Bithumb , is targeting an IPO https://x.com/WuBlockchain/status/2084194930193277136 in 2028 Strategy sold $105 million in Bitcoin https://decrypt.co/374831/strategy-sells-105m-in-bitcoin-as-dollar-reserve-hits-4b , funding preferred dividends and a STRC buyback. Corporate Treasuries & ETFs The Bitcoin ETFs saw $265M in net outflows https://www.coinglass.com/etf/bitcoin on Friday, ending the week with $60M in net outflows overall; the ETH ETFs saw $9M in inflows on Friday and $11M in net inflows on the week Meme Coin Tracker Meme leaders DOGE -1%, SHIB -3%, PEPE -1%, PENGU -1%, TRUMP +1%, BONK -3% were https://coinmarketcap.com/view/memes/ slightly red; Robinhood chain was led by FRONG +84% and Cashcat +20% ; Stonkbroker briefly reached $50M before retracing Solana leaders included CATE +130% , Manifet +69% and Kimchi +700% ; ANSEM -11% at $190M 💰 Token, Airdrop & Protocol Tracker DEX volumes reached 24% of CEX volumes https://x.com/WuBlockchain/status/2083797454668083444 in July, the highest they’ve ever recorded Polymarket and Kalshi reached $50B in volume https://x.com/WuBlockchain/status/2084120370735722981 in July, a new ATH New launchpad Flap flipped Pons https://x.com/DegenerateNews/status/2084062983332749354 in new daily launches on Sunday 🚚 What is happening in NFTs? NFT leaders were mixed; Punks even at 32.3 ETH, BAYC -3% at 8.16 ETH, Pudgy +2% at 3.86 ETH; Stonkbrokers soar to 6.9 ETH Pitboys +43% and Monkeyhood +200% led top movers