Long-dormant bitcoin wallets keep moving after a hardware wallet flaw drained about $89 million

A bitcoin wallet that had not moved coins since 2013 transferred about $31 million on Monday, and CoinDesk reports it was one of several long-inactive wallets to shift funds in the days after an attack on Coldcard hardware wallets.

The scale of that attack has grown since. A firmware defect dating to a March 2021 build routed key generation through a software random-number generator instead of the device's hardware source, which cut the effective strength of the resulting private keys far below what the device advertised. The first round of thefts took roughly 594 bitcoin, and CoinDesk reported on 2 August that losses had reached about $89 million across at least 4,585 addresses. Galaxy Research, the research arm of the digital-asset firm Galaxy, now puts the confirmed total at 1,596 bitcoin taken from about 7,300 addresses across three waves and fourteen smaller incidents, worth more than $100 million. The firm has also flagged a suspected fourth wave, which it excluded from that count because no victim has yet confirmed it. If the additional activity is verified, Galaxy says the total would rise to 2,055 bitcoin, or roughly $130 million. About 90 percent of the stolen coins have not moved since the thefts, and Galaxy has passed attacker and victim addresses to law enforcement and exchanges. Wallets protected by an additional passphrase, and those using multiple-signature setups, were not affected. Coinkite, the manufacturer, published patched firmware within days.

Bitcoin traded weakly through the episode. The coin opened Monday around $63,497 and traded near $62,600 by mid-morning in New York, and it did not rise even as equities rallied on the news from the Middle East. By early Tuesday it had recovered to about $63,500, leaving it close to where it started the week.

The wider adoption picture remains thin in places where governments are formalizing rules. TASS reported a survey by Rambler and Company finding that nearly 70 percent of Russians surveyed do not know what they would use cryptocurrency for, and that half said they do not use it at all and therefore cannot judge how legalization would affect them. The distance between regulatory activity and everyday use is a reminder that self-custody, the property that distinguishes bitcoin from a bank deposit, depends entirely on the integrity of the tools that hold the keys.