At least 15 attackers exploited the Coldcard vulnerability, resulting in damages exceeding $100 million

Alex Sohn, head of digital research at Galaxy, announced via a post on X (formerly Twitter) last Tuesday that at least 15 attackers have exploited a vulnerability in the Coldcard hardware wallet. This conclusion was reached after analyzing reports from victims since the incident. Unlike centralized exchange hacks, the attack characteristics were different, and additional attackers who were previously undetected have been identified. Sohn explained that a single report of a small loss of less than 1 BTC was a crucial clue, which led to the discovery of a new attack where 12 BTC was stolen from 126 addresses. According to Galaxy Research, the total amount of losses from the three confirmed attack waves is approximately $100 million. If the suspected fourth attack wave is included, the total losses in Bitcoin could reach around $130 million. This incident has reignited industry discussions about the security of cold storage wallets and the safety of individuals directly storing Bitcoin. Haseb Kureshi, managing partner at Dragonfly, cited social media reports, claiming that the vulnerability could have been prevented with just about $2 worth of AI hardening. Some social media users claimed that the AI model Claude was able to reproduce the vulnerability in just 8 minutes, and Kureshi added that even the open-source AI model GLM 5.2, in an environment where web searches were blocked, independently rediscovered the vulnerability within 20 minutes. However, Tassaporn Saereechittima, head of data at the crypto analysis platform Tokenomist, expressed skepticism about this claim in an interview with CoinTelegraph