Coldcard Bitcoin Hack: Victims Report Median Loss of 1 BTC as Theft Tops $111 Million

Bitcoin Magazine Coldcard Bitcoin Hack: Victims Report Median Loss of 1 BTC as Theft Tops $111 Million New analysis of Bitcoin theft reports reveals that stolen funds overwhelmingly came from long-dormant wallets, with victims reporting a median loss of over one coin.

Data posted on X from Galaxy Research’s Alex Thorn looked at 250 victim reports and found the typical stolen coin had sat untouched for 3.5 years, and a striking 88% of pilfered funds were at least a year old.  By address, losses ranged from a median of 0.014 Bitcoin to a mean of 0.212 Bitcoin, while individual victims reported a median loss of 1.022 Bitcoin and an average of 4.04 Bitcoin — with one unlucky holder losing as much as 58.97 coins.  Hackers started by taking over $35 million in Bitcoin from wallets last week Thursday.

Coinkite, which makes Coldcard, said that a firmware bug in Coldcard Mk3 devices — starting with version 4.0.1 in March 2021 — caused seed generation to fall back to a weak software Pseudorandom Number Generator instead of the hardware true random number generator, allowing hackers to essentially guess investor seedphrases.  The theft continued throughout the weekend while Coinkite and other Bitcoiners urged Coldcard users to immediately move their funds.

Galaxy Research said Friday that a total of $111 million has been confirmed...