The security of hardware wallets, long considered the gold standard for cryptocurrency self-custody, has come under intense scrutiny following a series of sophisticated onchain "sweeps" targeting users of Coldcard devices. Galaxy Research, a prominent digital asset research firm, has identified a third distinct wave of attacks leveraging a known vulnerability in certain Coldcard firmware versions. This latest escalation marks a shift in the attacker’s methodology, moving from high-value "whale" targets to a broader, more systematic draining of smaller balances, while simultaneously adopting advanced onchain techniques to obfuscate the movement of stolen funds.
According to data compiled by Galaxy Research, the third wave of these sweeps occurred between midday Friday and Saturday morning UTC. During this window, approximately 208 bitcoin (BTC) were drained from 1,912 unique addresses. While the total volume of this wave is lower than previous iterations, the sheer number of victims suggests a more automated and exhaustive approach to exploiting the vulnerable key space. The average haul per victim in this third wave was roughly 0.1 BTC (approximately $6,500 at current market prices), a significant decrease from the inaugural wave on July 30, which saw an average of nearly one full bitcoin per address.
A Chronology of the Exploits
The timeline of these attacks reveals a calculated progression by the actor or actors involved. The first wave, detected on July 30, was characterized by its speed and high-value focus. In a span of just 41 minutes, 1,083 bitcoin were siphoned from 1,196 addresses. This initial strike appeared to target the "low-hanging fruit"—addresses with substantial balances that were easily discoverable within the vulnerable key set.
Following an intermediate second wave, the cumulative losses across all three phases have now reached staggering proportions. Galaxy Research reports that 1,367 bitcoin have been stolen to date, representing nearly $89 million in lost assets. In total, ,4585 separate addresses have been compromised. The persistence of the attacks, which have continued for several days despite public disclosure of the vulnerability, suggests that the attackers are determined to "grind" through the entire set of predictable keys until every satoshi is recovered.
The Technical Vulnerability: Entropy and PRNG
The root cause of this massive security breach traces back to a specific firmware build released by Coinkite, the manufacturer of Coldcard, in March 2021. In the world of cryptography, the security of a private key is entirely dependent on its randomness, or entropy. To generate a secure 24-word seed phrase, a hardware wallet must use a high-quality Random Number Generator (RNG).
In the compromised March 2021 firmware, a critical error in the code caused the device to bypass its hardware-based RNG—which typically relies on physical noise or environmental randomness—and instead route seed generation through a predictable software-based "pseudo-random" number generator (PRNG). Because this software-based generator followed a predictable mathematical path, the "random" seeds it produced were not truly random.
This created a "bounded set" of possible keys. For a sophisticated attacker with sufficient computational power, it became possible to reproduce these keys offline. By pre-calculating the possible seed phrases that the flawed firmware could have generated, the attacker could check the Bitcoin blockchain for any addresses associated with those seeds that contained a balance. Once a match was found, the attacker possessed the private key necessary to move the funds without ever needing physical access to the victim’s device.
Evolution of Attacker Tactics in Wave Three
The third wave of attacks represents a notable tactical evolution. In the first two waves, the attacker utilized a handful of shared "collector" addresses. This made the theft relatively easy for blockchain analysts to map and track in real-time. However, the third wave has adopted a more fragmented approach.
Each victim’s funds are now being sent to a unique destination address rather than a centralized hub. Furthermore, the attacker has transitioned from using plain single-key outputs to Pay-to-Witness-Script-Hash (P2WSH) outputs. P2WSH is a SegWit address format that can carry complex scripts, such as multisignature requirements or timelocks. While the specific reason for this shift remains speculative, analysts suggest it could be a move to complicate automated tracking by exchange compliance tools or to prepare the funds for more complex laundering techniques.
The efficiency of the "sweeping" process has also changed. In the first wave, the attacker processed transactions one at a time. In the third wave, the attacker is "batching" an average of six victims into a single transaction. This reduces the total number of transactions the attacker must broadcast and lowers the aggregate transaction fees paid to miners. Interestingly, the third wave appears to be scanning only the "default derivation path"—the standard branch of the BIP-32/44 key tree that a wallet checks first—rather than testing multiple branches per seed, suggesting a focus on speed and volume over exhaustive depth.
Identity and Attribution
One of the most pressing questions for the cybersecurity community is whether these waves are the work of a single entity or multiple independent actors. Galaxy Research noted that while the chain itself does not distinguish between operators, they are confident that each individual wave is internally consistent with a single operator’s behavior. However, the firm has declined to officially link the three waves to the same individual or group.
It remains possible that after the first wave was publicly disclosed and the technical details of the flaw became known, other "copycat" attackers began grinding the same vulnerable key space. Alternatively, the original attacker may have simply updated their scripts to improve obfuscation and efficiency in response to the increased scrutiny from the research community.
Industry Reactions and Security Implications
The Coldcard exploit serves as a stark reminder of the "single point of failure" inherent in firmware-level security. Even when a device is "air-gapped"—meaning it never touches the internet—a flaw in the code that generates the keys can render all subsequent security measures moot.
While Coinkite has released subsequent firmware updates that corrected the RNG routing issue, the damage for users who generated their seeds during the vulnerable period remains permanent unless they move their funds to a newly generated seed. Security experts have long advised that hardware wallet users should utilize a "passphrase" (often called a 25th word). A passphrase adds a user-defined layer of entropy that is not generated by the device’s RNG. Even if the underlying 24-word seed is predictable and compromised, the attacker cannot access the funds without the unique passphrase.
Blockchain forensic firms are reportedly monitoring the movement of the 1,367 BTC. As the attacker attempts to move these funds to centralized exchanges or through mixing services, there is a possibility of freezing the assets, though the decentralized nature of Bitcoin makes this exceptionally difficult once funds are dispersed into thousands of separate addresses.
Broader Impact on the Crypto Ecosystem
The scale of this theft—nearly $90 million—places it among the most significant non-exchange-related hacks in recent history. It highlights a critical vulnerability in the "self-custody" narrative: the reliance on a small number of hardware manufacturers and the integrity of their closed or semi-closed source code.
For the broader market, the "sweeping" of such a large amount of Bitcoin creates a potential "overhang" of sell pressure. If the attacker chooses to liquidate these holdings on the open market, it could contribute to price volatility. However, given the current liquidity of the Bitcoin market, $89 million is a manageable volume, though the reputational hit to hardware wallet security may have more lasting effects on investor sentiment.
Galaxy Research continues to monitor the situation, noting that the "profitable end" of the vulnerable key space appears to have been picked over. As the average balance per victim drops, the economic incentive for the attacker to continue scanning may eventually diminish. However, for the thousands of users who may still have funds in addresses generated by the 2021 firmware, the message from the research community is clear: immediate action is required to migrate assets to a secure, newly generated seed phrase with a strong passphrase.
As the third wave of sweeps concludes, the incident stands as a landmark case study in the importance of entropy, the risks of firmware-level bugs, and the relentless nature of onchain predators in the digital asset space. The evolution from surgical strikes on high-value targets to a "scorched earth" approach on smaller balances underscores the reality that in the world of crypto-security, no balance is too small to be ignored by those with the tools to take it.
