Stolen BTC from Coldcard users nears $90M as people share their painful stories
"I lost years of hard work and time," said one victim.
Image by Cybernews.
- Over 1,432 BTC taken from more than 5,400 addresses in 5 days through a wallet bug, with North Korean hackers suspected among attackers.
- Users report losses including $1.6 million and years of weekly investments, with some losing their entire retirement cushion after 8 years of saving.
- Bitcoin's decentralized nature means no single solution exists; multisig wallets and passphrases require technical knowledge that could cause users to lose funds themselves.
- Security experts warn the crypto industry and users must adapt to new reality of AI-powered attacks, with some hoping for faster implementation of "covenants" to prevent such thefts.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
One of the most painful attacks on bitcoin (BTC) users is still ongoing as losses from Coldcard wallet-related thefts near $90 million. While people share stories about lost life savings, the industry is trying to figure out how wallet security has changed.
At the time of writing, per coldcard-hack.up.railway.app data, 1,432 BTC have already been stolen over the last 5 days from more than 5,400 addresses (a person can own multiple BTC addresses) due to the Coldcard bug, which Cybernews reported on last week.
Bitcoiners are trying to spread the story as widely as possible, as many Coldcard users are still unaware of the attack or still haven't moved their BTC to new wallets. On Sunday alone, almost 65 BTC were stolen, while Monday's data is yet to be announced. Overall, the theft is said to have happened in 9 waves so far, with the first one hitting on July 30th.
It is estimated that more and more criminals are trying to exploit the bug, while North Korea-affiliated hackers are also suspected to be among the attackers.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Besides creating new wallets, people are also trying to protect their funds by moving them to centralized crypto exchanges before they figure out their new wallet setup.
Meanwhile, due to bitcoin's decentralized nature, there is no single explanation for what the best practices should be going forward.
For example, wallet security could be increased by creating a multisig wallet, where a transaction must be confirmed by more than one private key, or by protecting a wallet with a passphrase. However, both pieces of advice might backfire, as both solutions require specific technical knowledge, without which people might lose their BTC themselves.
Therefore, security experts warn that the whole bitcoin and crypto wallet industry, as well as users, need to adjust to the new reality, as we might see more and more AI-enabled wallet thefts. However, some hope that this story will also encourage the bitcoin community to implement the so-called covenants faster, which could help protect against this kind of theft.
Either way, while the whole industry is now focused on fighting the immediate threat, helping people move their funds from Coldcard, and postponing other important decisions regarding wallet security standards and audits until later, victims are sharing their painful stories about how they lost life-changing sums in the attack.
"I just got robbed. $1.6 million dollars in bitcoin was drained from my account on July 29th in the @COLDCARDwallet hack. How's your day going?" one person shared.
Another user said they had been investing in BTC every week for years, only to have 2 BTC stolen in this attack.
"Looking back, I probably should’ve split it across wallets, or maybe just left it on Coinbase. I already know the multisig and don’t put it all in one place. Comments are coming, and yeah, that’s probably good advice," said the netizen and added that they did what they thought was right at the time based on what everyone in this space was telling them to do.
"That’s what makes this sting so bad," they said.
Another person on Reddit shared that they had hoped to have a good financial cushion before turning 50 after investing in BTC for 8 years.
"I lost years of hard work and time," they said.
Meanwhile, another poster on Reddit opined that "this attack is totally different from most other cases, because the affected users didn't do anything wrong," while adding that "the danger of AI is absolutely real and will only increase."
"Mass adoption is absolutely not going to happen this way," they said, adding that they still love the idea behind bitcoin and believe in its concept, but are struggling to find "good and honest answers" to these security challenges.
