At least 15 different attackers have exploited the Coldcard vulnerability, according to Galaxy Digital\u2019s head of research, Alex Thorn, citing new victim reports received since the incident.<\/p>\n
Thorn said<\/a> Tuesday that the victim reports helped the company label new attackers that would have gone undiscovered, as the nature of the exploit was different from a hack on a centralized exchange.\u00a0<\/p>\n \u201cDue to one single victim\u2019s report of less than 1 BTC stolen, we identified a new attack with 12 BTC siphoned from 126 addresses,\u201d Thorn wrote in a Tuesday X post.<\/p>\n The estimated losses from the Coldcard exploit have grown<\/a> to $100 million across three confirmed attack waves, according to Galaxy Research. The company also identified a suspected fourth wave<\/a> that could bring total losses to about $130 million in Bitcoin (BTC).<\/p>\n The ongoing attack reignited debate about the security of cold storage wallets and whether users are safer by holding their own Bitcoin.\u00a0<\/p>\n Roughly \u201c$2 of AI hardening\u201d could have prevented the Coldcard exploit, wrote<\/a> Dragonfly managing partner Haseeb Qureshi, citing social media reports that some AI models rediscovered the vulnerability that led to the attack in less than 20 minutes.<\/p>\n Qureshi\u2019s remarks came in response to multiple social media users claiming that Claude was able to regenerate the vulnerability in just eight minutes. He argued that these results may have been contaminated by web search and added that open-source AI model GLM 5.2 was able to rediscover the attack in 20 minutes with web access turned off.<\/p>\n However, it is unlikely that AI models would have independently discovered this vulnerability before it was made public, crypto analytics platform Tokenomist\u2019s data lead, Tatsapat Saerejittima, told Cointelegraph. He said:<\/p>\n \u201cThe claim that AI found it in 2 mins came from a pseudonymous Reddit user who scanned the code after the vulnerability had already become public. There was no blind test, no documented methodology, and no assessment of the model\u2019s false-positive rate.\u201d\u00a0<\/p><\/blockquote>\n Related: <\/strong><\/em>AI has not triggered DeFi \u2018hackpocalypse,\u2019 Dragonfly partner says<\/strong><\/em><\/a><\/p>\n Crypto research company Castle Labs\u2019 co-founder, Francesco, said that the growing capabilities of AI models are drastically reducing the cost and time it takes to discover new cryptocurrency vulnerabilities, but added that Coldcard\u2019s private key may have played a role in the vulnerability. <\/p>\n Coldcard used a \u201clevel of private key entropy (40 bits) much lower than the standard adopted by other wallets (a 12-word seed is 128 bits), a result of a firmware bug, making the job easier,\u201d he told Cointelegraph.<\/p>\n Francesco, who asked that Cointelegraph not use his last name, said he expects the cost of bug discovery to continue decreasing as AI models gain more capabilities and become more prominent in both cybersecurity and exploits.<\/p>\n Magazine: <\/strong><\/em>Does Botanix\u2019s failure prove Bitcoiners don\u2019t care about DeFi?<\/strong><\/em><\/a>\u00a0<\/strong><\/em><\/p>\n Related:<\/strong> Bitcoin price<\/a> \u00b7 BTC live chart<\/a> \u00b7 Ethereum price<\/a> \u00b7 ETH gas fee<\/a> \u00b7 Bitcoin price today<\/a> \u00b7 Top 10 cryptocurrencies<\/a><\/p>\n$2 worth of AI hardening could have prevented the exploit: Dragonfly partner<\/h2>\n
Vulnerability seen in private key setup<\/h2>\n