Coldcard vulnerability results in $130 million in losses as phishing attacks surge

Odaily Planet Daily reports that hardware wallet manufacturers Trezor and Foundation have warned of an increase in phishing attempts targeting hardware wallet holders following the disclosure of a Coldcard firmware vulnerability, with attackers seeking recovery phrases and诱导 users to download malware. Security firm Proofpoint found that phishing emails impersonated Coldcard, inviting users to complete a “hardware audit” and linking to cloned websites. After clicking, users download batch files hosted on GitHub that install the remote access tool ScreenConnect. Proofpoint noted that the fake websites also feature live customer service chat windows, where real individuals guide victims through the installation process. This remote access tool enables attackers to steal data and funds or deploy additional malware such as ransomware. Galaxy Research confirmed three rounds of theft since July 30, with a high-confidence loss of 1,596 BTC—over $100 million; if a fourth round, not yet confirmed with victims, is included, total losses could reach $130 million.