Galaxy Research Says Coldcard Addresses Created Since March 2021 Are at Risk

Bitcoin thefts tied to an entropy flaw in the Coldcard hardware wallet are ongoing, Galaxy Research said.

Alex Thorn, Galaxy Research's head of research, wrote on X on August 1 that "an active sweep attack is underway against all single-signature Coldcard addresses created after the March 2021 firmware update." Users with funds in those addresses should move them to a different address immediately.

Thorn said the attack began with sophisticated first, second and third waves of large-scale thefts. The attacks appear to have followed programmed patterns that may have used large language models, he wrote. Most of the stolen Bitcoin remains frozen in attacker-controlled addresses and has not moved.

More recently, smaller opportunistic attackers have joined in, with repeated attempts to launder funds through THORChain and overseas casinos.

Most of the stolen assets belonged to long-term Bitcoin holders. The average dormancy period for the stolen Bitcoin was 3.18 years, suggesting the losses were concentrated among users who kept assets in self-custody rather than on crypto exchanges or in decentralized finance.

Thorn also said restrictions on U.S.-made LLM models had forced investigators to use open-source Chinese AI models to trace and protect stolen funds. He said he would raise the related regulatory issues with senior U.S. government and industry officials.

Galaxy Research is collecting reports from victims and data on attacker addresses, and is sharing that information with U.S. law enforcement and industry participants as it continues the investigation.