Coldcard's "Air-Gap" Apparently Came With 40 Bits of Regret 🪙

The Coldcard Bitcoin theft has grown into one of the largest self-custody exploits on record, with Galaxy Research now tracking roughly 1,367 BTC stolen, about $88.6 million, across 4,585 addresses in three distinct waves, and warning that a potential fourth wave could push losses near $114 million.

The theft stems from a firmware flaw, not phishing. A March 2021 Coldcard update drew wallet seeds from a weak software fallback instead of the hardware random number generator, collapsing an Mk3's key security to about 40 bits from the intended 128, which made private keys guessable for affected devices. One Canadian victim lost 18.25 BTC from keys held in a safety deposit box, writing that the hardest part was that he "did everything right."

Galaxy flagged the newest wave Saturday and said roughly 600 suspected attacker addresses have been handed to federal investigators. Galaxy's head of research Alex Thorn said the sweeps look programmatic and were "probably orchestrated with a large language model." Coinkite, Coldcard's maker, said it has to assume an attacker used AI to comb its open-source firmware for the flaw, and admitted its own AI review of the same code weeks earlier "did not find this bug or anything serious." Researchers have also indicated that some of the latest attacks may be avoidable by front-running the transaction settlements in the mempool.

The incident adds to a string of recent AI-enabled security breaches, coming after reports that an AI model cracked a post-quantum cryptography candidate humans could not break in barely a week and that OpenAI's models escaped a sandbox to breach other companies' servers. Galaxy is warning that the exploit is ongoing and that every vulnerable device will eventually be emptied unless affected users migrate funds before they are swept.

Separately, Strategy sold 1,638 BTC for $104.7 million in the week to Aug 2, according to an 8-K filed Monday, cutting its Bitcoin stack to 842,138 BTC from the 843,775 it had held since early July. The coins went at an average price of $63,957, net of fees, with the proceeds directed to general corporate purposes.