Woofun AI reports that a sophisticated cryptographic failure within Coldcard’s firmware architecture enabled the extraction of over 1,000 bitcoin, valued at approximately $70 million, from 1,196 distinct wallets without any physical or digital interaction with the hardware devices themselves. This incident, mapped comprehensively by Galaxy Research and Block, represents a fundamental breach of the core value proposition of cold storage: the assumption that physical isolation guarantees security against remote exploitation.

The scale and precision of the theft were revealed through a detailed forensic timeline established on July 30. Within a narrow 41-minute window, specifically between 01:10 and 01:51 UTC, attackers successfully swept 1,082.65 BTC across six consecutive blocks on the bitcoin blockchain.

Notably, three intervening blocks contained no transactions related to the theft, suggesting that the malicious transfers were broadcast in calculated batches rather than as a continuous stream. The illicit proceeds were consolidated into four specific addresses, which have remained static since the initial extraction. Early reports had initially identified only one of these destination addresses, leading to a significant underestimation of the total loss; the final figure is nearly double the amount initially disclosed when the breach first surfaced. While the absolute value of this attack is smaller than some of the largest heists recorded this year, the mechanism employed renders it uniquely dangerous to the broader industry.

Traditional cryptocurrency theft typically relies on direct compromise: exchanges are breached, smart contracts are tricked, or private keys are phished from connected laptops. The defensive strategy has always been distance, a principle that hardware wallets are designed to enforce. By keeping the private key on a device that never connects to the internet, the theoretical model assumes there is nothing for an attacker to touch remotely.

However, this incident demonstrates that distance is irrelevant if the key generation process itself is fundamentally flawed. When a wallet is created, the device is supposed to generate a number so large and unpredictable that guessing it is computationally impossible. This number, known as the seed, serves as the root from which every address and private key is derived through fixed public rules.

The vulnerability originated in Coldcard’s firmware, which was intended to draw the seed from a dedicated hardware randomness generator.

However, an internal build setting inadvertently instructed the system to skip this secure generator. A check in a supporting library failed to verify whether the setting was active, testing only for its existence. Consequently, key generation fell back to a basic software substitute. This substitute was seeded using the chip’s serial number and its clock registers. The serial number is fixed factory metadata, while clock values represent timing state that an attacker can narrow down or measure on a device of their own. This regression transformed a secure cryptographic process into a predictable one.

Woofun AI data shows that the consequence of this fallback was a catastrophic collapse in the entropy of the generated keys. Security teams determined that the range of possible keys shrank from an unimaginably vast space to a countable one. For the older Mk2 and Mk3 models, the key generation was found to be entirely deterministic. For the newer Mk4, Q, and Mk5 models, the range was estimated at roughly four billion possibilities. While four billion is a large number to a human, it is trivial for modern computing power. This reduction in key space turned an unguessable secret into a solvable puzzle, exposing users to systematic enumeration attacks.

The attack method relied on brute-force enumeration rather than remote hacking. An attacker generates candidate seeds on their own machine, derives the corresponding bitcoin addresses for each candidate, and checks those addresses against the public blockchain, which is accessible to anyone. Every step of this process runs entirely on the attacker’s hardware. The victim’s device is not involved at any point and could be powered off in a safe on another continent. This decoupling of the attack vector from the physical asset highlights a critical shift in threat models: security is no longer just about protecting the device, but about ensuring the mathematical integrity of the key generation process.

Evidence of systematic sweeping was clear in the transaction patterns analyzed by Galaxy. Of the 1,196 drained wallets, 1,183 used the modern native segwit address format, seven used an older standard, and six used an even older one. No attacker targets specific victims across three different address formats simultaneously unless they are checking every possible output of a seed. This pattern confirms systematic enumeration, where each candidate seed is tested against every path it might have produced. The operator could widen the search, refine it, and return whenever they chose, demonstrating a high degree of control and patience in the exploitation process.

The ongoing risk remains significant because verification is nearly impossible for end-users. Galaxy warned that further waves of theft are likely if owners do not move their funds to new, secure wallets. Nor can an owner determine whether they are exposed; there is no test to run against one’s own wallet that reveals whether their seed sits inside the reproducible range. Coinkite, the maker of Coldcard, has warned Mk3 owners and claims its newer devices are unaffected.

However, Block’s report places the Mk2, Mk4, Q, and Mk5 in scope as well. Until this discrepancy is resolved, anyone who generated a seed on the affected firmware must assume the worst rather than attempt to verify their status.

The attacker made one critical mistake that aided identification. Clay Garrett of Block stated on X that the operator used a paid account at a well-known blockchain data provider to query the source addresses during the sweeps. The provider’s internal logs matched the suspected workflow with extraordinary specificity, detailing the number, timing, and sequence of requests. This data trail allowed investigators to confirm the hypothesis that the operator was actively querying the blockchain to identify funded addresses. Block has passed this information to authorities, providing a rare instance of digital forensics leading to a potential identification of the perpetrator.

This incident marks a pivotal moment in the evolution of cryptocurrency security. Cold storage promised that a key is unguessable, but the industry often interpreted this as a promise that a key is unreachable. The cost of finding and exploiting flaws in the former is falling rapidly. Anthropic published research on Tuesday showing one of its models halving the security of a candidate post-quantum algorithm in 60 hours, against a design that had survived two years of expert review. Storing a key safely is now the easier half of the problem; ensuring the key itself is mathematically secure is the new frontier.