At least 15 attackers exploited Coldcard vulnerability: Galaxy

At least 15 different attackers have exploited the Coldcard vulnerability, according to Galaxy Digital’s head of research, Alex Thorn, citing new victim reports received since the incident.

Thorn said Tuesday that the victim reports helped the company label new attackers that would have gone undiscovered, as the nature of the exploit was different from a hack on a centralized exchange.

“Due to one single victim’s report of less than 1 $BTC stolen, we identified a new attack with 12 $BTC siphoned from 126 addresses,” Thorn wrote in a Tuesday X post.

The estimated losses from the Coldcard exploit have grown to $100 million across three confirmed attack waves, according to Galaxy Research. The company also identified a suspected fourth wave that could bring total losses to about $130 million in Bitcoin ($BTC).

The ongoing attack reignited debate about the security of cold storage wallets and whether users are safer by holding their own Bitcoin.

$2 worth of AI hardening could have prevented the exploit: Dragonfly partner

Roughly “$2 of AI hardening” could have prevented the Coldcard exploit, wrote Dragonfly managing partner Haseeb Qureshi, citing social media reports that some AI models rediscovered the vulnerability that led to the attack in less than 20 minutes.

Qureshi’s remarks came in response to multiple social media users claiming that Claude was able to regenerate the vulnerability in just eight minutes. He argued that these results may have been contaminated by web search and added that open-source AI model GLM 5.2 was able to rediscover the attack in 20 minutes with web access turned off.

However, it is unlikely that AI models would have independently discovered this vulnerability before it was made public, crypto analytics platform Tokenomist’s data lead, Tatsapat Saerejittima, told Cointelegraph. He said:

“The claim that AI found it in 2 mins came from a pseudonymous Reddit user who scanned the code after the vulnerability had already become public. There was no blind test, no documented methodology, and no assessment of the model’s false-positive rate.”

Vulnerability seen in private key setup

Crypto research company Castle Labs’ co-founder, Francesco, said that the growing capabilities of AI models are drastically reducing the cost and time it takes to discover new cryptocurrency vulnerabilities, but added that Coldcard’s private key may have played a role in the vulnerability.

Coldcard used a “level of private key entropy (40 bits) much lower than the standard adopted by other wallets (a 12-word seed is 128 bits), a result of a firmware bug, making the job easier,” he told Cointelegraph.

Francesco, who asked that Cointelegraph not use his last name, said he expects the cost of bug discovery to continue decreasing as AI models gain more capabilities and become more prominent in both cybersecurity and exploits.

Magazine: Does Botanix’s failure prove Bitcoiners don’t care about DeFi?