Coldcard vulnerability investigation upgraded: at least 15 attackers discovered, single victim lead finds 12 BTC stolen

In comparison, Alex Thorn, head of research at Galaxy Digital, said that according to new victim reports received after the incident, the number of Coldcard vulnerability attackers had reached at least 15.

According to Thorn, the information provided by the victims helped the research team uncover previously unidentified attacks. Since this vulnerability attack method is different from the centralized exchange theft incident, the connection between attackers needs to be confirmed by on-chain analysis and victim feedback.

He said that just one victim reported less than 1 BTC stolen helped the team uncover a previously unknown attack that stole around 12 BTC from 126 addresses.

According to Galaxy Research's previous estimates, the Coldcard vulnerability has led to at least three rounds of attacks, which cost about $100 million in BTC; in addition, Galaxy also discovered a suspected fourth round of attacks, which could raise the total losses to about $130 million.

At the same time, the incident also sparked discussions about the security of Bitcoin's self-custody. Dragonfly managing partner Haseeb Qureshi said that the “$2 cost AI security hardening” may be able to avoid this vulnerability, adding that some AI models can rediscover related vulnerabilities in a relatively short period of time. However, industry insiders pointed out that current claims about how quickly AI finds vulnerabilities lack strict blind testing and verification.

Researchers believe that as AI model capabilities improve, vulnerability detection and attack costs in the cryptographic industry may continue to decline, and wallet developers need to further strengthen code audits and security protection.