Coldcard Attack Escalates: Fourth Wave Pushes Bitcoin Theft Past $90 Million

TheNewsCryptoPubblicato 2026-08-03Pubblicato ultima volta 2026-08-03

Introduzione

The Coldcard hardware wallet attack has escalated into a major security crisis, with estimated thefts now exceeding $90 million from over 4,500 wallets. The flaw, present in Mk3 devices running firmware v4.0.1 to v5.0.3, resulted in seed phrases with lower entropy, making them predictable. A confirmed fourth wave of attacks recently stole approximately 448.73 BTC from 709 addresses over a 2.5-hour period. Manufacturer Coinkite has destroyed vulnerable inventory, halted shipments, and released patched firmware. However, the update only secures newly generated seeds; wallets created on the vulnerable firmware remain at high risk and require immediate migration of funds. The company has suggested alternative wallets and asked affected users to retain their devices for potential recovery efforts. This incident severely damages trust in a leading cold storage solution.

What started as a warning has become one of the most serious hardware wallet security incidents in Bitcoin’s history. Over the past three days, Coldcard devices running vulnerable firmware have been drained by attackers who discovered a critical flaw.

The seed phrases generated by affected devices had lower entropy than intended, making them predictable and exploitable. The damage had reached an estimated $90 million stolen from over 4,500 wallets, with over 1,367 BTC drained across multiple coordinated waves of attacks.

The Fourth Wave Is Still Active

Alex Thorn, Head of Research at Galaxy Research, flagged a likely fourth wave. The pattern across blocks 960,778 to 960,792, spanning roughly 2.5 hours, showed 218 transactions hitting 462 victim addresses, with 216 fresh destination wallets receiving 388.92 BTC.

The sweep activity was running at approximately 45 times the normal rate, 13.8 sweeps per block versus a baseline of 0.3. Moreover, every transaction showed zero inputs predating the Coldcard firmware boundary. The topology was 1:1, one fresh destination per victim, with no collector funnel.

After correcting for six addresses with prior transaction history, the surviving core of wave 4 stands at 709 addresses and 448.73 BTC. Also, some stolen funds have already moved to second-hop addresses. Transactions still carrying RBF opt-in signals may offer a narrow window for victims to respond.

What Coldcard Has Done?

Coinkite, the Canadian company behind Coldcard, confirmed the vulnerability and moved quickly. All remaining units at their facilities with affected firmware were destroyed, and the shipments have been halted. Those who had received affected orders were contacted directly with migration steps.

Patched firmware is now available for every affected model, but the fix only protects newly generated seed phrases. Any seed created on the vulnerable firmware remains at risk regardless of the update. Users must generate a new wallet and move all funds immediately.

Satscard, Opendime, and Tapsigner use different codebases and are not affected. For users needing an immediate alternative, Coldcard has suggested Bitkey, Ledger, Trezor, Jade, and Bitbox as temporary options.

Additionally, it has asked the affected users to keep their devices to support any future recovery efforts. The affected firmware versions are Coldcard Mk3, running v4.0.1 through v5.0.3.

An exploit of this scale hitting a device widely regarded as one of Bitcoin’s most trusted cold storage solutions shakes confidence in hardware wallet security broadly.

Crypto Market Highlights

Ethereum (ETH) Falls to $1.8K: Bulls and Bears Clash at a Critical Level

Crypto di tendenza

CitreaCTR

wrapped stUSDTWSTUSDT

Velodrome FinanceVELODROME

BrevisBREV

ZRX（0X）ZRX

PancakeSwapCAKE

Domande pertinenti

QWhat is the core security issue affecting Coldcard hardware wallets as described in the article?

AThe affected Coldcard devices were running firmware that generated seed phrases with lower entropy than intended. This made the seed phrases predictable and exploitable, allowing attackers to drain the wallets.

QAccording to Alex Thorn's analysis, what characterizes the fourth wave of attacks in terms of transaction activity?

AThe fourth wave showed sweep activity running at approximately 45 times the normal rate, with 13.8 sweeps per block compared to a baseline of 0.3. The transactions followed a 1:1 topology (one fresh destination address per victim) with no collector funnel.

QWhat actions has Coinkite, the maker of Coldcard, taken in response to the vulnerability?

ACoinkite destroyed all remaining units with affected firmware at their facilities, halted shipments, and directly contacted customers who received affected orders. They have released patched firmware for affected models and suggested temporary alternative wallet options for users.

QDoes updating to the patched firmware protect seed phrases generated on the vulnerable firmware?

ANo, the patched firmware only protects newly generated seed phrases. Any seed phrase created on the vulnerable firmware remains at risk. Users must generate a new wallet and move all their funds immediately.

QWhich Coldcard models and firmware versions are affected by this vulnerability?

AThe affected models are the Coldcard Mk3, running firmware versions v4.0.1 through v5.0.3.

Letture associate

BitMEX Founder Arthur Hayes Makes Major Purchase of This Altcoin! Here Are the Details

Arthur Hayes, founder of BitMEX, has significantly increased his investment in Ethereum. According to data from on-chain analytics platform Onchain Lens, Hayes purchased approximately 1,337 ETH using 2.5 million USDC. The transaction was executed via his Galaxy Digital account. Hayes also transferred an additional 2.5 million USDC to his account on institutional digital asset platform FalconX. This transaction was pending at the time of reporting, with market observers speculating the funds may also be used to purchase Ethereum or another digital asset. Hayes is known for his optimistic views on Ethereum and the DeFi ecosystem. He has previously suggested that improving global liquidity conditions and expectations for monetary policy easing could support risk assets like Ethereum. While analysts note that large purchases alone don't dictate price direction, they view the sustained interest in Ethereum from institutional and major private investors as a positive long-term signal for the market. The purpose of the second FalconX transfer is expected to become clearer with future on-chain data.

cryptonews.ru4 min fa

BitMEX Founder Arthur Hayes Makes Major Purchase of This Altcoin! Here Are the Details

cryptonews.ru4 min fa

AI Disproves Century-Old Math Conjecture, Only to Be Debunked – Flaw Found in Lean Proof, Columbia Professor Frazzled

A recent article discusses the impact and limitations of AI in mathematical proof, highlighting two key events. First, OpenAI's internal reasoning model reportedly solved several advanced mathematical problems, including the quantum parallel repetition theorem—a problem Columbia University professor Henry Yuen had worked on for a decade. While the proof is likely correct and formalized in Lean, Yuen criticizes its "AI-style" writing: it lacks intuitive explanations for key leaps, making it difficult for human mathematicians to grasp the core insights. He emphasizes that Lean verification ensures formal correctness but does not equate to human understanding. Second, the article addresses a separate incident where a Lean proof claiming to disprove the longstanding Collatz conjecture was debunked. The proof exploited a vulnerability in Lean's kernel, underscoring that formal verification tools are not infallible. Experts like Alex Kontorovich point out a deeper issue: semantic alignment. Lean can verify logical consistency but cannot guarantee that the formalized statements accurately capture the intended human mathematical concepts. This alignment still requires expert human oversight. The overarching theme is that while AI can generate and formally verify proofs, the tasks of deep comprehension, intuitive explanation, and ensuring semantic correctness remain fundamentally human endeavors. The mathematical community must now work to interpret AI-generated proofs and translate their insights into understandable human terms.

marsbit8 min fa

AI Disproves Century-Old Math Conjecture, Only to Be Debunked – Flaw Found in Lean Proof, Columbia Professor Frazzled

marsbit8 min fa

Making the Silent Oracle Bones Speak for Three Thousand Years: The First AI-Assisted Interpretation System Mimicking Human Expert Workflow

Breaking the silence of three-thousand-year-old oracle bone inscriptions (OBI) poses immense challenges for researchers, who traditionally rely on laborious cross-referencing across fragmented historical materials. To address this, researchers from Huazhong University of Science and Technology and collaborating institutions have developed AlphaOracle, the first AI system designed to simulate the expert workflow for deciphering OBI. The system integrates a four-step, evidence-based pipeline: 1) parsing and reading-order reconstruction of oracle bone rubbings; 2) morphological analysis of character evolution across historical scripts; 3) contextual verification using large-scale OBI corpora and a specialized masked language model; and 4) literature validation against classical texts and modern scholarly works. AlphaOracle generates comprehensive, traceable reports with candidate interpretations, confidence scores, and source citations for expert review, functioning as an intelligent assistant rather than a final arbiter. In evaluations involving 86 domain experts, 78.7% found the system helpful, estimating an average 64% reduction in analysis time. The system achieved a top-1 accuracy of 23.1% on deciphering withheld known characters and significantly outperformed general-purpose large language models in contextual reasoning tasks. AlphaOracle successfully analyzed several controversial characters, with some results incorporated into authoritative OBI databases. This work demonstrates a promising paradigm where AI enhances the breadth and efficiency of material retrieval and hypothesis generation, while human experts retain the crucial role of deep scholarly judgment, paving the way for systematic AI-assisted research in paleography.

marsbit9 min fa

Making the Silent Oracle Bones Speak for Three Thousand Years: The First AI-Assisted Interpretation System Mimicking Human Expert Workflow

marsbit9 min fa

Cyber Godfather Tibo Reveals: Google Had ChatGPT a Year Earlier but Dared Not Release It

In a recent revelation, Thibault "Tibo" Sottiaux, the Codex lead at OpenAI, confirmed that Google developed a ChatGPT-like chatbot called "LMChat" a full year before OpenAI's launch. According to Tibo, who was part of the Google team at the time, the company was too cautious to release it, fearing it might disrupt its core search and advertising business. DeepMind, where the project was housed, was also restricted from launching products that could compete with Google's existing services. This account aligns with past statements from former Google Brain head Jeff Dean, who mentioned an internal chatbot that was deemed inferior to Google Search at the time. The article highlights this as a classic case of "innovator's dilemma," comparing Google's hesitation to Xerox's failure to commercialize groundbreaking technologies like the graphical user interface in the 1970s. The piece further notes a recent wave of high-profile departures from Google's AI teams to rivals like OpenAI and Anthropic, including key figures such as Transformer co-author Noam Shazeer and AlphaFold lead John Jumper. It concludes that Google's excessive caution and internal constraints, driven by the need to protect its lucrative search business, ultimately cost it a pioneering position in the generative AI revolution, allowing OpenAI to seize the initiative with ChatGPT's public release in November 2022.

marsbit18 min fa

Cyber Godfather Tibo Reveals: Google Had ChatGPT a Year Earlier but Dared Not Release It

marsbit18 min fa

Solana Foundation CISO Warns AI Is Making Crypto Scams More Convincing

Solana Foundation's Chief Information Security Officer, Michael Coates, warns that AI is making crypto scams significantly more convincing by enhancing social engineering, phishing, and voice impersonation tactics. The threat targets users and teams directly, not a flaw in blockchain technology itself. AI enables polished, personalized messages and convincing deepfakes, increasing the risk of irreversible financial losses from actions like approving malicious transactions. Coates emphasizes the need for "secure by default" systems across the crypto ecosystem, as traditional user-focused warnings are insufficient against sophisticated AI-driven deception. This includes safer wallet designs, clearer transaction approvals, and stronger internal team procedures like out-of-band verification and multi-signature controls. The warning applies broadly, as AI allows scammers to operate at scale with professional-looking attacks, necessitating a fundamental shift in security approaches beyond user vigilance.

bitcoinist31 min fa

Solana Foundation CISO Warns AI Is Making Crypto Scams More Convincing

bitcoinist31 min fa

Trading

Spot

Articoli Popolari

Come comprare ONE

Benvenuto in HTX.com! Abbiamo reso l'acquisto di Harmony (ONE) semplice e conveniente. Segui la nostra guida passo passo per intraprendere il tuo viaggio nel mondo delle criptovalute.Step 1: Crea il tuo Account HTXUsa la tua email o numero di telefono per registrarti il tuo account gratuito su HTX. Vivi un'esperienza facile e sblocca tutte le funzionalità,Crea il mio accountStep 2: Vai in Acquista crypto e seleziona il tuo metodo di pagamentoCarta di credito/debito: utilizza la tua Visa o Mastercard per acquistare immediatamente HarmonyONE.Bilancio: Usa i fondi dal bilancio del tuo account HTX per fare trading senza problemi.Terze parti: abbiamo aggiunto metodi di pagamento molto utilizzati come Google Pay e Apple Pay per maggiore comodità.P2P: Fai trading direttamente con altri utenti HTX.Over-the-Counter (OTC): Offriamo servizi su misura e tassi di cambio competitivi per i trader.Step 3: Conserva Harmony (ONE)Dopo aver acquistato Harmony (ONE), conserva nel tuo account HTX. In alternativa, puoi inviare tramite trasferimento blockchain o scambiare per altre criptovalute.Step 4: Scambia Harmony (ONE)Scambia facilmente Harmony (ONE) nel mercato spot di HTX. Accedi al tuo account, seleziona la tua coppia di trading, esegui le tue operazioni e monitora in tempo reale. Offriamo un'esperienza user-friendly sia per chi ha appena iniziato che per i trader più esperti.

432 Totale visualizzazioniPubblicato il 2024.12.12Aggiornato il 2026.06.02

Discussioni

Benvenuto nella Community HTX. Qui puoi rimanere informato sugli ultimi sviluppi della piattaforma e accedere ad approfondimenti esperti sul mercato. Le opinioni degli utenti sul prezzo di ONE ONE sono presentate come di seguito.