Hackers steal nearly $89 million from Bitcoin wallets thought to be offline | News. az
Hackers have stolen around $88. 6 million worth of Bitcoin from thousands of cryptocurrency addresses linked to vulnerable Coldcard hardware wallets, highlighting how a flaw in wallet seed generation can. . .
Hackers have stolen around $88. 6 million worth of Bitcoin from thousands of cryptocurrency addresses linked to vulnerable Coldcard hardware wallets, highlighting how a flaw in wallet seed generation can expose funds even when devices are kept offline. According to Galaxy Research, three waves of suspicious transactions drained approximately 1,367 BTC from 4,585 addresses. The first wave began on July 30, when 1,082. 65 BTC was drained from 1,195 addresses in just 41 minutes. About 27 hours later, a second wave lasted three hours and 42 minutes and removed another 76. 16 BTC from 1,478 addresses. RECOMMENDED STORIESHackers access data on 31,000 companies and entities in LiechtensteinBitcoin faces a quantum computing threat: should investors really be worried?Bitget Wallet Card adds cashback in Bitcoin, gold, and tokenized stocksBitcoin risks falling to $59,000 as Iran tensions send oil prices higherGalaxy Research said the second wave affected more addresses despite involving significantly less Bitcoin, a pattern consistent with an automated system searching through potentially compromised private keys. The addresses targeted in the first two waves did not overlap. A third wave later drained another 207. 73BTC, bringing the total estimated loss to about 1,367 BTC, worth approximately $88. 6 million. Researchers said the third wave followed a substantially different pattern, meaning there is not enough evidence to determine whether the same attacker was behind all three stages. The stolen Bitcoin has reportedly remained unmoved on the blockchain. Most of the affected addresses appeared to belong to individual Bitcoin holders rather than cryptocurrency exchanges or institutional custodians. Wallets holding less than 1 BTC represented the majority of victims, although several larger wallets accounted for a significant share of the financial losses. One victim, Canadian entrepreneur Jonathan Goodman, said 18. 25 BTC worth more than 1. 6 million Canadian dollars was stolen from his wallet. Goodman said the Coldcard device had been kept offline inside a bank safety deposit box and had never been connected to the internet. The manufacturer of Coldcard wallets, Coinkite, traced the incident to a flaw in the process used to generate wallet seed phrases. A seed phrase is a sequence of words that functions as the master key for accessing cryptocurrency stored in a wallet. According to Coinkite, the vulnerability was introduced in a March 2021 software update. The affected firmware used a software-based pseudorandom number generator instead of properly relying on the device’s hardware random number generator. That reduced the unpredictability of some seed phrases and potentially allowed attackers to reconstruct private keys without physically accessing the affected devices. Coldcard Mk2 and Mk3 wallets running firmware versions 4. 0. 1 through 4. 1. 9 are among the affected devices. Seeds generated on certain versions of the Mk4, Mk5 and Q models are also considered vulnerable, although Coinkite said newer models retained more randomness and were therefore less severely affected. Wallets whose seed phrases were generated using at least 50 independent and private dice rolls are not considered exposed to this particular flaw. A strong and unique BIP-39 passphrase can also provide additional protection. Coinkite warned that simply updating a Coldcard device does not fix a seed phrase that was generated using vulnerable firmware. Affected users have been advised to install the corrected firmware, create a completely new seed phrase and transfer their funds to a new wallet. The company also recommends verifying the new address and carrying out a small test transaction before transferring the rest of the balance. TAPSIGNER, SATSCARD and OPENDIME products were not affected because they use different codebases. Blockchain analysis firm Chainalysis found that the attacker initially targeted wallets containing the largest balances. One victim reportedly lost around $1. 8 million, while the total value of stolen Bitcoin reached approximately $30 million within the first 10 minutes of the attack. About 500 addresses were emptied during the following 25 minutes. Block engineer Clay Garrett said investigators had also identified a possible clue about the attacker’s operating method. Internal records from a blockchain services provider reportedly matched the number, timing and sequence of queries associated with the suspicious transactions. The company found no evidence that the provider knowingly participated in the attack, while the information gathered was passed to law enforcement. Ledger said its hardware wallets were not affected because its devices use a certified hardware random number generator within their Secure Element. Bitcoin developer Peter Todd separately warned that owners of multisignature wallets should exercise caution when transferring funds, as such transactions can expose public keys that were previously hidden on the blockchain. The incident underscores a key security risk for cryptocurrency holders: keeping a hardware wallet offline does not necessarily protect funds if the private keys or seed phrases were generated using compromised or predictable randomness. The attack also comes amid a broader rise in physical and technical threats targeting cryptocurrency holders. Earlier, Qazinform reported that CertiK recorded 52 physical attacks against crypto holders worldwide during the first half of 2026, with estimated financial exposure of about $124. 1 million. News. AzBy Aysel Mammadzada