Coldcard Thefts Near $114 Million as Fourth Attack Wave Hits
A 2021 firmware bug made Coldcard wallet seeds guessable, enabling attackers to drain over 1,800 BTC ($114 million) in a fourth attack wave since Thursday. Victims may still rescue coins by outbidding the attackers in the mempool.
A firmware bug introduced in 2021 made Coldcard hardware wallet seeds guessable. Attackers have exploited it in a fourth wave, draining over 1,800 BTC—worth nearly $114 million—since Thursday. The latest sweep transactions remain pending in the mempool, allowing victims to outbid attackers and potentially rescue their funds.