Key facts
- At least 15 attackers exploited a Coldcard vulnerability.
- Estimated losses from the Coldcard exploit reached $100 million.
- The attacks occurred across three confirmed waves.
- Swan CEO stated users are migrating to multisig solutions.
- Ledger's CTO warned of the need for AI-resistant security.
- Bitcoin's mempool transaction count reached 89,031 on Tuesday.
- The mempool transaction count was the highest since February 2025.
- A wallet linked to the hacker received messages and small Bitcoin deposits.
- Messages included pleas for funds and offers to launder money.
A critical vulnerability in Coldcard hardware wallets has resulted in substantial financial losses, with Galaxy Digital reporting at least 15 attackers exploiting the flaw across three confirmed attack waves, leading to estimated losses of $100 million. The exploit has triggered a wave of reactions and security considerations within the cryptocurrency industry. Swan Bitcoin CEO Cory Klippsten noted that the incident is not leading users away from self-custody but rather encouraging a migration to more secure, collaborative multisig solutions for bitcoin protection. This sentiment is echoed by Ledger's CTO, who views the Coldcard exploit as a stark warning to the hardware Bitcoin wallet sector. He emphasized the urgent need for security protocols to evolve and become resistant to AI-driven vulnerability discovery, capable of defending at machine speed. Ledger's own devices reportedly remained unaffected due to their reliance on certified hardware random number generators. The increased network activity following the hack is evident in Bitcoin's mempool, which saw a transaction count of 89,031 on Tuesday, marking its highest point since February 2025. This surge in network activity also coincided with multi-month highs in active addresses and transactions from large bitcoin holders. In a peculiar turn of events, a wallet associated with the Coldcard hacker has transformed into a public forum. This wallet has received numerous small Bitcoin deposits, each accompanied by messages. These messages range from urgent pleas from victims seeking the return of their stolen funds to offers from individuals willing to assist in laundering the illicitly obtained assets.