{"id":24432,"date":"2026-08-04T01:38:40","date_gmt":"2026-08-04T01:38:40","guid":{"rendered":"https:\/\/nft.runfyers.com\/index.php\/2026\/08\/04\/bitcoin-cold-wallet-attack-spreads-to-4500-addresses-as-losses-near-89-million-nft-plazas\/"},"modified":"2026-08-04T01:38:40","modified_gmt":"2026-08-04T01:38:40","slug":"bitcoin-cold-wallet-attack-spreads-to-4500-addresses-as-losses-near-89-million-nft-plazas","status":"publish","type":"post","link":"https:\/\/nft.runfyers.com\/index.php\/2026\/08\/04\/bitcoin-cold-wallet-attack-spreads-to-4500-addresses-as-losses-near-89-million-nft-plazas\/","title":{"rendered":"Bitcoin Cold-Wallet Attack Spreads to 4,500 Addresses as Losses Near $89 Million – NFT Plazas"},"content":{"rendered":"

<\/p>\n

\n

A sophisticated attack exploiting a years-old vulnerability in Bitcoin cold wallets has expanded significantly, with blockchain researchers estimating that nearly <\/span>$89 million<\/b> worth of BTC has now been stolen from <\/span>more than 4,500 wallet addresses<\/b>. The campaign, which targets wallets created using vulnerable <\/span>COLDCARD<\/b> firmware released in <\/span>March 2021<\/b>, has evolved through multiple attack waves and may still be ongoing.<\/span><\/p>\n

According to <\/span>Onchain Lens<\/b><\/a>, the exploit does not compromise hardware wallets directly. Instead, attackers are reproducing private keys generated from weak recovery seeds, allowing them to drain wallets that have remained offline for years. The incident highlights a rare but severe risk in hardware wallet security: a flaw introduced during wallet creation can permanently undermine even fully air-gapped storage.<\/span><\/p>\n

Bitcoin cold-wallet attack spreads to 4,500 addresses as losses near $89 million<\/span><\/i><\/p>\n

Three confirmed attack waves<\/b><\/h2>\n

The attack first came to light on <\/span>July 30<\/b>, when approximately <\/span>1,083 BTC<\/b> was stolen from <\/span>1,196 addresses<\/b> in just <\/span>41 minutes<\/b>. The speed and coordination of the transactions suggested the attacker had already mapped a large portion of the vulnerable key space before launching automated wallet sweeps.<\/span><\/p>\n

Researchers also observed notable changes in the attacker\u2019s behavior.<\/span><\/p>\n

Instead of consolidating stolen funds into a handful of collector wallets, each victim\u2019s Bitcoin was sent to a separate destination address, making blockchain tracing more difficult. The attacker also switched to <\/span>Pay-to-Witness-Script-Hash (P2WSH)<\/b> outputs, which support more advanced spending conditions such as multisignature or timelock scripts.<\/span><\/p>\n

Meanwhile, each transaction now swept funds from multiple victims simultaneously, improving efficiency compared with the first wave, where addresses were emptied one by one. Galaxy said these operational changes could indicate either the same attacker adapting after public attention or another actor independently exploiting the same vulnerable wallets.<\/span><\/p>\n

Three confirmed attack waves<\/span><\/i><\/p>\n

A flaw dating back to 2021<\/b><\/h2>\n

Unlike most crypto thefts involving phishing attacks or malware, this exploit originates from a firmware bug introduced in <\/span>March 2021<\/b>.<\/span><\/p>\n

Researchers found that one COLDCARD firmware release mistakenly generated wallet recovery seeds using a predictable software randomizer rather than the device\u2019s secure hardware random number generator. Because Bitcoin private keys are derived from those recovery seeds, affected wallets were created with significantly weaker cryptographic entropy.<\/span><\/p>\n

Attackers can therefore reproduce the vulnerable private keys entirely offline using computing power alone, without ever accessing the victim\u2019s hardware wallet or connecting it to the internet.<\/span><\/p>\n

The implication is particularly alarming for long-term Bitcoin holders. Once a weak recovery seed has been generated, the wallet remains vulnerable regardless of whether the device is disconnected from the internet, locked inside a safe, or stored in a bank vault.<\/span><\/p>\n

Galaxy estimates the Bitcoin stolen during the first three confirmed waves had remained untouched for an average of <\/span>3.18 years<\/b>, indicating many victims believed their assets were securely stored for the long term.<\/span><\/p>\n

Researchers warn of a possible fourth wave<\/b><\/h2>\n

The campaign may still be unfolding.<\/span><\/p>\n

On <\/span>August 3<\/b>, Galaxy Research Head <\/span>Alex Thorn<\/b><\/a> identified transaction patterns consistent with what appears to be a <\/span>fourth attack wave<\/b>. During roughly <\/span>2.5 hours<\/b>, researchers detected <\/span>218 suspicious transactions<\/b> involving <\/span>462 suspected victim addresses<\/b>, representing activity roughly <\/span>45 times higher<\/b> than normal.<\/span><\/p>\n

Galaxy Research Head Alex Thorn\u2019s Status on X<\/span><\/i><\/p>\n

After filtering out false positives and multisignature wallets, Galaxy narrowed the suspected dataset to approximately <\/span>709 addresses<\/b> holding around <\/span>448.7 BTC<\/b>. However, Thorn cautioned that this latest phase has not yet been definitively confirmed because the analysis relies on transaction patterns rather than direct reports from victims.<\/span><\/p>\n

Despite the uncertainty, Galaxy published the findings immediately because some affected users may still have an opportunity to protect their funds.<\/span><\/p>\n

A brief chance to recover funds<\/b><\/h2>\n

Unlike earlier attacks, many suspected fourth-wave transactions were broadcast using <\/span>Replace-by-Fee (RBF)<\/b>, a Bitcoin feature that allows an unconfirmed transaction to be replaced by another paying a higher network fee.<\/span><\/p>\n

If victims discover the outgoing transaction while it remains in the <\/span>mempool<\/b>, they may still be able to submit a higher-fee replacement transaction and transfer their Bitcoin to a secure wallet before miners confirm the attacker\u2019s transfer.<\/span><\/p>\n

Thorn urged anyone who may have generated a wallet using the vulnerable firmware to immediately verify their balances and migrate remaining funds to wallets created with fresh recovery seeds.<\/span><\/p>\n

Self-custody faces renewed scrutiny<\/b><\/h2>\n

The incident is also influencing broader Bitcoin custody trends.<\/span><\/p>\n

Following <\/span>FTX\u2019s collapse<\/span><\/a> in 2022, many investors embraced the principle of <\/span>\u201cNot your keys, not your coins,\u201d<\/b> moving assets from centralized exchanges into self-custodied hardware wallets. The COLDCARD incident shows that while self-custody removes exchange risk, it does not eliminate technical risks arising from flawed wallet generation.<\/span><\/p>\n

According to <\/span>CryptoQuant<\/b>, Bitcoin transfers involving less than <\/span>1 BTC<\/b> briefly surged to around <\/span>39,600 BTC<\/b> in a single day, marking the highest level since FTX\u2019s bankruptcy. Separate blockchain analysis also shows centralized exchanges recorded <\/span>net inflows exceeding 15,000 BTC<\/b> on August 1, with platforms including <\/span>Binance<\/b><\/a>, <\/b>Kraken<\/b><\/a>, OKX,<\/b> and <\/span>River<\/b> receiving much of the incoming Bitcoin.<\/span><\/p>\n

Meanwhile, Galaxy Research has shared roughly <\/span>600 suspected attacker addresses<\/b> with U.S. federal investigators, blockchain compliance firms, and cybersecurity partners to support ongoing investigations.<\/span><\/p>\n

For users who may have initialized wallets using the affected firmware, researchers say updating software alone is insufficient. The safest course of action is to create an entirely new wallet with a fresh recovery seed and immediately transfer all remaining Bitcoin, as any wallet generated using the flawed firmware should be considered permanently compromised.<\/span><\/p>\n<\/div>\n

Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

A sophisticated attack exploiting a years-old vulnerability in Bitcoin cold wallets has expanded significantly, with blockchain researchers estimating that nearly $89 million worth of BTC has now been stolen from more than 4,500 wallet addresses. The campaign, which targets wallets created using vulnerable COLDCARD firmware released in March 2021, has evolved through multiple attack waves […]<\/p>\n","protected":false},"author":1,"featured_media":24433,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true},"categories":[16],"tags":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/nftplazas.com\/wp-content\/uploads\/2026\/08\/1-4.jpg","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/posts\/24432"}],"collection":[{"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/comments?post=24432"}],"version-history":[{"count":0,"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/posts\/24432\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/media\/24433"}],"wp:attachment":[{"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/media?parent=24432"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/categories?post=24432"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/tags?post=24432"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

A second wave followed soon after, while a third wave over the weekend shifted focus toward wallets with much smaller balances. <\/span>Galaxy Research<\/span><\/a> estimates roughly <\/span>207.7 BTC<\/b> was drained during this latest confirmed phase, bringing total observed losses to approximately <\/span>1,367 BTC<\/b>, worth <\/span>nearly $89 million<\/b>, across <\/span>4,585 Bitcoin addresses<\/b>.<\/span><\/p>\n