A third wave of bitcoin thefts linked to weak keys generated by older Coldcard wallet firmware has pushed total losses to 1,367 bitcoin, worth nearly US$89 million, across 4,585 addresses, according to crypto firm Galaxy Research.

Galaxy said the latest wave drained about 208 bitcoin from 1,912 addresses between Aug. 1 and Aug. 2 Coordinated Universal Time (UTC).

The first wave on July 30 stole 1,083 bitcoin from 1,196 addresses in 41 minutes. Galaxy traced the vulnerability to code introduced in March 2021 that allowed attackers to recreate a limited set of private keys offline.

Coldcard wallets are made by Canadian hardware wallet maker Coinkite. The company said seeds generated on Mk2 and Mk3 firmware versions 4.0.1 through 4.1.9 are vulnerable unless users added sufficient private dice entropy or used a strong, unique BIP-39 passphrase.

Seeds created on Mk4, Mk5, and Q devices before fixed firmware releases are also affected.

Coinkite said fixed firmware, including Mk2/Mk3 version 4.2.0, is available, but updates do not repair existing seeds.

🔗 Source: CoinDesk