Coldcard Vulnerability Investigation Escalates: At Least 15 Attackers Identified, Single Victim Clue Leads to Discovery of 12 BTC Stolen

Odaily Planet Daily News Galaxy Digital Head of Research Alex Thorn stated that based on new victim reports received after the incident, the number of attackers exploiting the Coldcard vulnerability has reached at least 15.

Thorn said that information provided by victims helped the research team identify attack campaigns that had not been previously recognized. Since this vulnerability attack differs from centralized exchange theft incidents, the connections between attackers need to be confirmed through on-chain analysis and victim feedback.

He noted that a single victim reporting less than 1 BTC stolen helped the team uncover a previously unknown attack that siphoned approximately 12 BTC from 126 addresses.

According to Galaxy Research's earlier estimates, the Coldcard vulnerability has led to at least three rounds of attacks, with losses of approximately $100 million in BTC; in addition, Galaxy has also discovered a suspected fourth round of attacks, which could bring total losses to approximately $130 million.

Meanwhile, the incident has also sparked discussions about the security of Bitcoin self-custody. Dragonfly Managing Partner Haseeb Qureshi stated that an "AI security hardening costing about $2" could potentially have prevented this vulnerability, and noted that some AI models were able to rediscover the related vulnerability in a relatively short period of time. However, industry insiders pointed out that current claims about the speed of AI vulnerability discovery lack rigorous blind testing and verification.

Researchers believe that as AI model capabilities improve, the cost of vulnerability discovery and attacks in the crypto industry may continue to decline, and wallet developers need to further strengthen code audits and security protections. (Cointelegraph)