# Theft Related Articles

HTX News Center provides the latest articles and in-depth analysis on "Theft", covering market trends, project updates, tech developments, and regulatory policies in the crypto industry.

Coldcard Vulnerability Leads to $89 Million Theft, Sparking Largest On-Chain Migration Since FTX Collapse

A security vulnerability in Coldcard hardware wallets led to the theft of 1,367.05 BTC (approx. $89 million) from 4,585 addresses, according to Galaxy Research. The flaw, caused by insufficient randomness in seed phrase generation for specific firmware versions, triggered a massive migration of funds as users moved assets to new, secure wallets. This event caused the largest on-chain movement of small Bitcoin transactions since the FTX collapse, distorting key market indicators like active addresses and exchange deposits, and significantly dampening market sentiment. The incident also highlighted challenges in cybersecurity investigations, as researchers reported that safety guardrails on mainstream U.S. AI models hindered the analysis of attack patterns, forcing them to use an open-source Chinese AI model for forensic work. This underscores a dilemma in balancing AI security restrictions with the need for rapid response in tracing stolen crypto assets.

marsbit08/03 03:16

Coldcard Vulnerability Leads to $89 Million Theft, Sparking Largest On-Chain Migration Since FTX Collapse

marsbit08/03 03:16

Suspected 4th Coldcard attack wave sweeps 389 Bitcoin: Galaxy’s Thorn

Coldcard hardware wallet users are facing a new wave of coordinated attacks targeting a firmware flaw, with researcher Alex Thorn flagging 218 recent transactions moving approximately 389 Bitcoin from potentially impacted addresses. The attack pattern shows a high rate of transactions targeting unique victim addresses, differing from previous waves. The vulnerability, which causes affected devices to generate weaker wallet seeds, is estimated to have impacted over 1,100 wallets, leading to around $90 million in Bitcoin stolen. Thorn advises affected users who control their keys may attempt to move funds with a higher-fee transaction before the attacker's transactions are confirmed.

cointelegraph08/03 02:13

Suspected 4th Coldcard attack wave sweeps 389 Bitcoin: Galaxy’s Thorn

cointelegraph08/03 02:13

Bitcoin Withdrawals Continue: 8 Years of Storage in a Coldcard Cold Wallet Ended in Zero

Coldcard Hardware Wallet Hacked: Losses Mount Due to Vulnerable Seed Generation A critical vulnerability in Coldcard hardware wallets has led to a continued wave of fund thefts. According to Galaxy Research, the total stolen has reached 1,367.05 BTC (approx. $88.6 million) from 4,585 addresses, a significant increase from the initial 594.5 BTC reported on July 30, 2026. Most of the stolen funds remain on the attackers' addresses. The issue is not with the current firmware, which Coinkite has updated, but with seed phrases generated on vulnerable devices between March 2021 and the release of fixed firmware versions. Due to a programmer error, devices switched from using a hardware random number generator to the software-based Yasmarang generator, which was initialized with publicly accessible data like the chip's serial number. This made the seed phrases predictable through offline brute-force attacks, meaning wallets remain at risk until funds are moved to a new wallet generated with the patched firmware. Affected devices include Mk2/Mk3 with firmware 4.0.1–4.1.9 (and up to 5.0.3), Mk4/Mk5 up to version 5.6.0, and Q models up to 1.5.0Q. The only exceptions are seeds created with a high-entropy method like at least 50 independent dice rolls or a strong unique BIP-39 passphrase. All other owners must generate a new seed on the fixed firmware and transfer their assets. A case highlighting the human impact involves a 39-year-old long-term investor who lost 2 BTC (approx. $130,000) in minutes. He had accumulated the Bitcoin over eight years through physical labor, viewing it as a financial lifeline and a retirement plan in a country suffering from hyperinflation. His story underscores that even conservative "buy and hold in cold storage" strategies can be compromised by such underlying technical flaws. From a technical perspective, this incident echoes historical failures where weak random number generators undermined cryptographic security, challenging the assumption that offline storage is automatically foolproof.

cryptonews.ru08/02 15:26

Bitcoin Withdrawals Continue: 8 Years of Storage in a Coldcard Cold Wallet Ended in Zero

cryptonews.ru08/02 15:26

Following the Coldcard Hack, One of the Largest Bitcoin Wallet Hacks Recently, a New Wave of Losses Begins! Losses Are Mounting

Following a major hack targeting Coldcard hardware wallets, losses have surged to approximately 1,367 BTC ($88.6 million) across 4,585 addresses. The third wave of attacks stole an additional 207.7 BTC, exhibiting different patterns from the first two. While initial attacks used shared deposit addresses and targeted P2WPKH wallets, the latest wave employed unique recipient addresses per victim and focused on P2WSH addresses. Analysis by Galaxy Research cannot definitively link all three waves to the same attacker, raising the possibility of a second actor exploiting the known vulnerability. The stolen funds, predominantly from wallets holding under 1 BTC, remain unspent. The vulnerable Coldcard firmware was released in March 2021, and all stolen coins originate from after that date.

cryptonews.ru08/02 09:55

Following the Coldcard Hack, One of the Largest Bitcoin Wallet Hacks Recently, a New Wave of Losses Begins! Losses Are Mounting

cryptonews.ru08/02 09:55

Attention, Bitcoin Users! Today's Hack May Be Larger Than You Think. Here's What to Do

Bitcoin users are urged to take immediate action following the disclosure of a critical security vulnerability. Hardware wallet manufacturer Coinkite has revealed a flaw in the seed phrase generation process for certain Coldcard Mk3 devices running firmware versions 4.0.1 through 5.0.3. All bitcoin addresses created from seed phrases generated on these potentially affected devices are now considered at risk. This warning coincides with an ongoing investigation into a major hack that drained approximately 1,082.65 BTC (worth roughly $70.2 million at the time) from 1,196 single-signature wallets in just 41 minutes on July 30. Security analysts believe the coordinated thefts, which used identical transaction fees and left no change, were executed by an automated tool scanning for compromised private keys. Notably, this attack occurred about 30 hours before Coinkite's public disclosure of the Coldcard vulnerability, raising concerns of a possible connection. Experts strongly recommend that impacted Coldcard Mk3 users do not consider their old seed phrase safe. The advised course of action is to generate a completely new, secure seed phrase on a trusted, modern hardware wallet and then transfer all funds to addresses derived from this new seed. Simply moving the old, potentially compromised seed to a new device is not sufficient.

cryptonews.ru07/31 22:01

Attention, Bitcoin Users! Today's Hack May Be Larger Than You Think. Here's What to Do

cryptonews.ru07/31 22:01

Russian Organizes Underground Crypto Farm in a Container

A Russian entrepreneur established an underground cryptocurrency mining farm inside a metal container in a residential area of Shelekhov, Irkutsk Oblast. According to the regional prosecutor's office, the operation, set up in February, involved 27 mining devices. Investigators allege the equipment was illegally connected to the power grid, bypassing electricity meters, to mine cryptocurrency without paying for the substantial energy consumed. The estimated damages to the power supply company exceed 23 million rubles. Authorities have shut down the illegal farm and seized all the equipment. A criminal case has been initiated for property damage through fraud or abuse of trust, which carries a maximum penalty of five years in prison and a fine. This incident occurs in a region where cryptocurrency mining faces restrictions. Since April 7, 2025, a ban on mining has been in effect across 29 municipalities in southern Irkutsk Oblast, including Shelekhov and its district, applying to individuals, entrepreneurs, and legal entities. Previously, police in the region discovered another illegal mining farm located in a forest belt near the village of Stolbova.

cryptonews.ru07/28 09:21

Russian Organizes Underground Crypto Farm in a Container

cryptonews.ru07/28 09:21

AFX Bizarre Theft Case: Audit Report Full of Holes, Suspected Parent Company is Crypto Exchange Phemex

The decentralized perpetual exchange AFX suffered a hack on its cross-chain bridge, resulting in the theft of over $24 million, effectively draining the protocol's TVL. Following the incident, scrutiny fell on a security audit report released in early June by firm Zellic. The report itself raised significant red flags, stating it only covered part of the bridge's components, lacked testing of critical security paths, and was conducted without access to a live or local environment for proper validation. Prominent figures, including MetaMask's Taylor Monahan, criticized the report as alarming, noting numerous confirmed issues were left unaddressed and suggesting the team exhibited negligent security practices, potentially with a single point of control. Further investigation reveals strong ties between AFX and the centralized exchange Phemex. Key evidence includes a core AFX team member's previous role as Phemex's Head of Listing, overlapping social connections, Phemex's now-deleted blog posts actively promoting AFX, and nearly identical brand aesthetics. Notably, Phemex itself experienced a major $70+ million hack in January 2025, attributed at the time to North Korean hackers. The close association between the two entities, coupled with AFX's deeply flawed audit and subsequent major breach, raises serious questions about security standards and potential internal risks, leaving the true nature of the incident—whether another external attack or an internal scheme—unclear.

链捕手07/24 07:14

AFX Bizarre Theft Case: Audit Report Full of Holes, Suspected Parent Company is Crypto Exchange Phemex

链捕手07/24 07:14

3 crypto attacks in 24 hours – From fake apps to a $14.2M SOL theft

The cryptocurrency space witnessed a high volume of attacks within 24 hours, highlighting several major security threats. First, fraudsters targeted SecondFi by creating fake browser extensions and apps to steal crypto; the company clarified its official channels and warned against unsolicited links. In a separate incident, a compromised early Solana whale wallet led to the theft of 180,900 SOL (worth $14.2 million), with the stolen funds being bridged to Ethereum and laundered via Tornado Cash. Finally, the jscrambler npm package suffered a supply chain attack where stolen credentials were used to publish malicious versions containing an information-stealing payload. These events underscore the prevalence of phishing, wallet exploits, and software supply chain vulnerabilities, emphasizing the need for vigilance, verifying official sources, and prompt software updates.

ambcrypto07/12 19:03

3 crypto attacks in 24 hours – From fake apps to a $14.2M SOL theft

ambcrypto07/12 19:03

Cardano Wallets Hit By SecondFi Exploit As Private Key Flaw Sparks Security Warning

SecondFi, previously linked to the Yoroi wallet, has halted services following a critical security flaw in its proprietary web-based wallet generation software. The vulnerability reportedly exposed private keys, leading to a significant theft of ADA tokens. Initial reports estimate losses of 16 million ADA (~$2.4M) from 374 wallets, while security firm SlowMist warns the broader impact could exceed 129 million ADA (over $20M). Crucially, the incident was confined to SecondFi's software; the Cardano blockchain protocol itself was not compromised. The core issue involves insecure private key generation, allowing attackers access to affected wallets. A primary warning for users is to avoid restoring compromised seed phrases into other wallets, as this would not resolve the underlying key exposure. Users are also cautioned against unverified recovery links or third-party refund platforms. The situation underscores that blockchain security extends beyond the protocol layer to include wallet software and key management. The community awaits a full post-mortem and confirmation of the final impact.

bitcoinist06/27 03:01

Cardano Wallets Hit By SecondFi Exploit As Private Key Flaw Sparks Security Warning

bitcoinist06/27 03:01

Exploit Wallet Converts Stolen Tokens Into 18,510 ETH And 1,548 BNB

An exploit-linked wallet has reportedly converted stolen assets into 18,510 ETH (approximately $30.83 million) and 1,548 BNB ($924,000). According to on-chain tracking data cited by WuBlockchain and Lookonchain, the attacker sold compromised "H tokens" to obtain these more liquid assets and still holds an additional 111.36 million H tokens worth about $14 million. This conversion into major cryptocurrencies like ETH and BNB is a common step after an exploit, as attackers move from illiquid, traceable tokens toward deeper, more liquid assets. This consolidation can signal potential next steps, such as moving funds through bridges or mixers, and complicates recovery efforts for security teams. While blockchain analysis provides real-time visibility into such transactions, the identity of the wallet controller often remains uncertain. The data serves as a valuable snapshot of fund movement, highlighting the role of on-chain monitors in tracking security incidents before official investigations are complete.

bitcoinist06/13 18:43

Exploit Wallet Converts Stolen Tokens Into 18,510 ETH And 1,548 BNB