Hackers steal nearly $89mln from ‘offline’ Bitcoin wallets

Three waves of suspicious transactions drained a total of approximately 1,367 BTC from 4,585 addresses.

The first wave occurred on July 30, when 1,082.65 BTC was drained from 1,195 addresses within 41 minutes. Around 27 hours later, a second wave began and lasted three hours and 42 minutes, draining another 76.16 BTC from 1,478 addresses.

Although the second wave involved fewer bitcoins, it affected more addresses. Galaxy Research said this pattern was consistent with an automated tool systematically searching through potentially compromised private keys. The groups of addresses targeted during the first two waves did not overlap.

A third wave later drained another 207.73 BTC, bringing the total losses to around 1,367 BTC, or $88.6 million, across 4,585 addresses.

Researchers said the third wave followed a substantially different pattern. As a result, there is currently insufficient evidence to conclude that the same operator was responsible for all three stages of the attack. The stolen funds have reportedly remained unmoved on the Bitcoin blockchain.

Galaxy Research said most of the affected addresses appeared to belong to individual Bitcoin holders rather than cryptocurrency exchanges or institutional custodians. While addresses holding less than one BTC accounted for most victims, much of the financial damage came from several larger wallets.

One of the victims, Canadian entrepreneur Jonathan Goodman, said 18.25 BTC worth more than 1.6 million Canadian dollars had been taken from his wallet. According to Goodman, the Coldcard device was kept offline in a bank safety deposit box and had never been connected to the internet.

The manufacturer of Coldcard wallets, Coinkite, traced the incident to a flaw in the process used to generate wallet seed phrases. A seed phrase is a sequence of words that serves as the master key for accessing cryptocurrency held in a wallet.

The problem was introduced during a software update in March 2021. According to Coinkite’s technical explanation, the firmware relied on a software-based pseudorandom number generator instead of properly using the device’s hardware random number generator. This significantly reduced the unpredictability of some seed phrases and may have allowed attackers to reconstruct private keys without gaining physical access to the devices.

Coldcard Mk2 and Mk3 wallets running firmware versions 4.0.1 through 4.1.9 are among the affected devices. Seeds generated on certain versions of the Mk4, Mk5 and Q models are also considered vulnerable, although the manufacturer said newer models retained more randomness and were therefore less severely affected.

Wallets whose seed phrases were created using at least 50 independent and private dice rolls are not considered exposed to this particular flaw. A strong and unique BIP-39 passphrase also provides an additional layer of protection.

Coinkite stressed that simply updating a device does not repair a seed phrase generated by vulnerable firmware.

Users have been advised to install the corrected firmware, generate a completely new seed phrase and transfer their funds to a new wallet. The company also recommended verifying the new address and making a small test transaction before moving the remaining balance.

TAPSIGNER, SATSCARD and OPENDIME products were not affected because they use different codebases.

Chainalysis found that the attacker initially focused on wallets holding the largest amounts. One victim lost around $1.8 million, while the combined value of the stolen Bitcoin reached approximately $30 million within the first ten minutes. Around 500 addresses were emptied over the following 25 minutes.

Block engineer Clay Garrett said investigators had also identified a likely element of the attacker’s operating method. Internal records from a blockchain services provider reportedly matched the number, timing and sequence of queries associated with the suspicious transactions. The company found no evidence that the provider knowingly participated in the attack, while the collected information was handed over to law enforcement agencies.

Ledger said its hardware wallets were not affected, as its devices use a certified hardware random number generator within their Secure Element.

Bitcoin developer Peter Todd also warned that owners of multisignature wallets should exercise caution when transferring funds, as doing so can reveal public keys that were not previously visible on the blockchain.

Earlier, Qazinform News Agency reported that physical attacks targeting cryptocurrency holders surged in the first half of 2026. According to CertiK, 52 such incidents were recorded worldwide, with the financial exposure reaching approximately $124.1 million. France accounted for 33 of the reported cases.