A vulnerability in Coldcard hardware wallets has now persisted through four separate waves of exploitation, resulting in the draining of idle Bitcoin wallets. Long-term holders who have not yet migrated their funds remain exposed to ongoing attacks.

As previously reported by Cryptopolitan, the initial breach affecting approximately 500 wallets was not an isolated incident, and cumulative losses have since surpassed $70 million.

As of August 3, users across multiple versions of Coinkite-manufactured Coldcard wallets remain at risk. The only confirmed mitigation is to transfer all holdings to newly derived, securely generated wallets as quickly as possible. Because Bitcoin transactions are irreversible once confirmed on-chain, any funds swept by the attacker are almost certainly unrecoverable through normal channels.

Coldcard devices have historically been popular among Bitcoin maximalists and were widely recommended for cold storage. However, recent demonstrations by white hat hackers have shown that vulnerable addresses can be identified using just minutes of AI-powered computation.

Prior to the fourth wave, Galaxy Research data indicated that estimated losses encompassed 1,196 addresses totaling 1,086.65 BTC.

Fourth Wave Shows Increased Aggression

On-chain researchers tracking Coldcard-associated addresses and BTC transactions have confirmed the launch of a fourth wave of exploits.

As of August 3, the attacker continued generating new destination wallets. Following each completed sweep, the addresses remained idle for several hours before the next batch was targeted.

According to Alex Thorn of Firmwide Research, the fourth wave likely includes attempted attacks against multisig wallets, a departure from the pattern observed in the first three waves. Multisig configurations require multiple private keys to authorize a transaction and are generally considered more resilient than single-key setups, making this escalation a notable shift in the attacker's capabilities. An estimated 857 addresses were targeted in this wave, with losses of approximately 486.11 BTC.

The attacker deployed multiple destination wallets, using freshly generated addresses to systematically sweep funds from Coldcard users before consolidating the proceeds into larger wallets.

Reports of losses have surfaced across multiple cryptocurrency community influencers and commentators, including posts on X and further accounts.

A core challenge with Coldcard devices is their typical use case as cold storage solutions, making them less accessible for rapid fund transfers and security updates. Some users had even engraved their private keys on metal plaques for physical durability, yet this measure proved ineffective against the exploit.

The attacker appears to rely on computationally intensive processes to expose successive batches of vulnerable wallets. While this approach may slow the pace of new address sweeps, the underlying vulnerability persists, and additional waves beyond the fourth remain possible.

Broader Implications for Bitcoin Self-Custody

For years, the prevailing Bitcoin narrative has positioned self-custody as the gold standard for asset security. Exchange hacks, frozen accounts, and privacy concerns have been the primary arguments driving users to take their coins off centralized platforms.

While Bitcoin has been lost to compromised wallets in the past, a mass exploitation event tied to a specific hardware device represents an unprecedented development. Hardware wallets from manufacturers such as Ledger and Trezor have not reported comparable systemic entropy failures, underscoring how the Coldcard vulnerability stems from implementation-specific code modifications rather than an inherent flaw in cold storage principles.

Further examination of the Coldcard codebase revealed that the platform had deliberately modified approximately 2,500 lines of code with minimal documentation, introducing weak entropy in the wallet creation process, as noted by Bitcoin advocate @hodlonaut on X. In cryptographic terms, entropy refers to the randomness used to generate private keys; when entropy is weak or predictable, the resulting keys can be reproduced by an attacker with sufficient computational resources.

Reports indicate that a more robust entropy function was disabled to ensure the code executed without issues, potentially exposing thousands of wallets to discovery by adversaries.

The Coldcard incident has also heightened scrutiny around weakly derived seeds, which can now be identified using rented computational resources. Jameson Lopp recalled on X that other widely used wallets had previously disclosed entropy-related flaws and issued patches before any exploitation occurred. The contrast is instructive: transparent disclosure and remediation before exploitation is the industry norm, and the Coldcard case illustrates the consequences when a vulnerability of this nature goes unpatched. Nonetheless, weakly derived addresses in cold storage remain a viable target for AI-assisted attacks.