Coldcard Attacker Used Blockchain Services Provider to Query Wallets, Investigators Say

Introduction

A fresh twist has emerged in the record-breaking Coldcard wallet heist. According to an engineer involved in the investigation, the attacker likely used a paid account at a well-known blockchain services provider to query source addresses and conduct related activity while sweeping stolen Bitcoin. The disclosure adds a significant forensic layer to a theft that has already exposed a deeply rooted firmware flaw affecting years of hardware-wallet users.

More than $70 million in Bitcoin has been drained from wallets in what is now one of the largest hardware-wallet security incidents in crypto history. The attack exploited a weak pseudorandom number generator in Coldcard Mk3 devices, and Coinkite, the manufacturer, has admitted that all its models are potentially affected.

Key Developments

• Clay Garrett, an engineer at Block, reported on X that investigators identified an unusual pattern in the attacker's sweeps and traced it to a paid account at a top blockchain services provider.
• The attacker is believed to have used the services provider to query source addresses during the sweeps, likely to determine which wallets held the most vulnerable funds.
• Galaxy Digital's research arm noted that while the movement pattern links the thefts to a single attacker, the initial exploit itself was not identifiable simply by observing the blockchain — it looked like a legitimate coin owner moving funds.
• Coinkite has confirmed that the vulnerability stems from a firmware bug introduced in March 2021 with version 4.0.1, causing seed generation to fall back to a weak software PRNG instead of the hardware TRNG.
• Engineers warn that additional Bitcoin addresses may still be at risk, especially single-signature wallets created without dice rolls or a strong BIP-39 passphrase.

Market Impact Analysis

The immediate market reaction has been cautious. Bitcoin prices have remained volatile, though the structural implications of the incident are more concerning than the direct sell pressure. The theft of $70 million is not large enough to move BTC prices permanently, but the news could dampen sentiment around hardware wallet security and self-custody practices.

For Ethereum and altcoins, the spillover effect is likely neutral. This is a Bitcoin-specific event centered on a niche hardware wallet product. However, the broader narrative of custody risk could prompt some traders to reassess exchange-traded fund premiums and institutional flows. In the short term, any additional disclosure about vulnerable wallets could intensify bearish pressure on Bitcoin. Over the long term, the market may absorb this as a painful but instructive lesson about open-source security and the importance of verifiable randomness in hardware wallets.

Outlook

As Coinkite scrambles to provide guidance and potential firmware patches, the crypto community faces an uncomfortable reality: even the most trusted hardware wallets are not immune to subtle and catastrophic flaws. Investigators are now tracing the stolen funds through blockchain analytics, but the use of a paid blockchain services provider suggests the attacker may have had a level of operational sophistication that could slow recovery efforts.

Affected users are being urged to move funds out of single-signature Coldcard addresses into secure custody solutions while the scope of the vulnerability is fully understood. The incident is also likely to accelerate demand for multi-sig setups and independent key verification, as well as push hardware wallet manufacturers toward greater transparency in their random number generation processes. For now, the market watches closely as forensic teams track the attacker's digital trail and as Coinkite works to rebuild trust among its users.

Source: Bitcoin Magazine