Galaxy Digital says Coldcard attack losses could rise to 2,000 BTC

Galaxy Research said the potential damage from a security flaw in Coldcard hardware wallets could rise to as much as 2,000 BTC ($130 million), according to The Block. The research team said three attacks and 14 smaller security incidents have so far led to the theft of 1,596 BTC from 7,300 addresses. It explained the incident stemmed from a random number generation flaw in firmware used by the Coldcard Mk3 through Mk5 and Coldcard Q, while issuer Coinkite has already deployed an emergency update. Galaxy Research added total losses could reach 2,055 BTC if a fourth attack, which has not yet been fully confirmed, is included. It said the fourth attack follows the same pattern as the earlier incidents, and that it is working with U.S. federal investigators and exchanges on the response. The research also found 90% of the stolen funds have not yet moved.