- Published on
Hardware Wallet Firms Warn of Phishing Surge as Coldcard Losses Near $130M
- Authors
- Name
- DeepHorus
Hardware wallet makers Trezor and Foundation have warned of a surge in phishing attempts following the Coldcard firmware exploit. Scammers are chasing recovery phrases and pushing malicious downloads. Both firms said their own hardware remains unaffected. The warnings come as attackers trade on the disclosed vulnerability.
The exploit stems from a March 2021 firmware build that used a software fallback instead of the hardware random number generator, leaving private keys guessable. Galaxy Research confirmed three waves of thefts since July 30. High-confidence losses are 1,596 BTC, above $100 million, and a fourth wave may push the total to $130 million.
Alex Thorn of Galaxy Research said Tuesday that at least 15 separate attackers are exploiting the flaw. Every wave but the first was identified through victim reports. The exploit remains ongoing.
Security firm Proofpoint documented a phishing campaign targeting Coldcard users on Monday. Spoofed emails invite a "coordinated hardware audit" and link to a cloned site whose "Start Hardware Audit" button pulls a batch file from GitHub. That installs ScreenConnect, a legitimate remote-access tool, enabling data theft, financial fraud, or ransomware.
The fake site's chat window is staffed by a real person, not a bot, who walks victims through the installation. Proofpoint called it an effective social engineering lure that "preys on the fear and concern" holders have about crypto security. The campaign is designed to seem urgent and official, increasing the chance of success.
Trezor told users to enter backups only on the device itself. Foundation warned of impersonating emails pushing malicious downloads, adding it will never ask for recovery phrases or recommend installing software to secure a wallet. Both firms stressed that legitimate security updates never require manual installation of remote-access tools.
Similar campaigns hit Trezor and Ledger users in February, a fake Ledger app in April, and fake GitHub issues in March. Coinkite has issued patched firmware, but Galaxy urged holders to move funds to fresh seeds or a custodian. That gives these phishing lures a long potential shelf life.
