Hackers have stolen an estimated $130 million worth of cryptocurrency by exploiting a security flaw in Coldcard hardware wallets, raising fresh concerns over the safety of offline digital asset storage.

Blockchain security firms said at least a dozen hacking groups are targeting Bitcoin owners who use Coldcard wallets, a hardware device manufactured by Coinkite and widely regarded as one of the most secure methods of storing cryptocurrencies.

According to Galaxy Research, the coordinated attacks have resulted in losses of about $130 million as of Tuesday.

The estimate was corroborated by Tom Robinson, co-founder and chief scientist at blockchain analytics firm Elliptic.

The latest incident adds to a growing wave of cyberattacks on the cryptocurrency industry. Data from blockchain security company TRM Labs shows that more than 200 crypto-related hacks have occurred this year, resulting in losses exceeding $950 million.

The Coldcard breach is particularly significant because hardware wallets are designed to keep users’ private keys or seed phrases offline, making them less vulnerable to online attacks than internet-connected “hot” wallets offered by crypto exchanges and software applications.

However, security researchers at Block discovered that a flaw in the way certain Coldcard devices generated seed phrases made them predictable.

Attackers were able to exploit this weakness by using brute-force techniques to recreate victims’ seed phrases, enabling them to gain access to and steal their Bitcoin holdings.

The incident underscores the growing sophistication of cybercriminals targeting digital assets and highlights the need for stronger security measures, even for products designed to provide offline protection.