Coldcard Wallet Losses Approach $114 Million

Analysis of potential losses from an exploit targeting Coldcard hardware wallets indicates that users may have lost close to $114 million. This figure is derived from the tracking of approximately 1,000 Bitcoin transactions that appear to be affected by the exploit. The exploit leverages a technique known as "replace-by-fee" (RBF), a legitimate feature within the Bitcoin protocol that allows users to increase the transaction fee of a pending transaction to incentivize miners to prioritize it. In this malicious application, an attacker monitors the Bitcoin mempool, a holding area for unconfirmed transactions. Upon identifying a transaction from a Coldcard wallet, the attacker quickly submits a new transaction to the network that replaces the original one by offering a significantly higher transaction fee. This effectively allows the attacker to "sweep" the funds from the victim's wallet before the legitimate transaction can be confirmed. The speed at which this replacement must occur means that victims have only minutes to react once their transaction is visible in the mempool. Reports suggest that a possible fourth sweep of funds is emerging, further indicating the ongoing nature and sophistication of the attack. The Coldcard is a popular hardware wallet known for its focus on security and air-gapped operation, designed to keep private keys offline and away from internet-connected devices. This exploit, however, appears to circumvent some of these security measures by targeting the interaction between the wallet and the broader Bitcoin network during transaction broadcasting. The total value of Bitcoin potentially lost is estimated to be around 3,000 BTC, which, at an approximate Bitcoin price of $38,000 per BTC, equates to the $114 million figure. The exploit's success relies on the attacker's ability to monitor the mempool and react faster than the victim or any automated defenses. This incident highlights the evolving threats within the cryptocurrency space and the importance of understanding the underlying mechanisms of blockchain networks, including features like RBF, which can be exploited when combined with sophisticated attack strategies. Further investigation into the precise method of the exploit and the number of affected wallets is ongoing, with the cryptocurrency community actively monitoring the situation and sharing information to mitigate further losses.