BTC cold wallet attack thefts reach $89M

TLDR

A flaw in certain Coldcard Bitcoin hardware wallets has enabled attackers to steal around 1,367 BTC, worth roughly $88.689 million, across multiple waves of attacks.

1. A March 2021 Coldcard firmware bug weakened seed generation, letting attackers reconstruct private keys and sweep about 1,367 BTC from roughly 4,585 addresses.
2. The risk is specific to affected Coldcard setups, but the incident is pushing many Bitcoin (BTC) holders to rethink self-custody versus exchanges and other custodial options.
3. Ongoing sweeps, unmoved stolen coins, and incomplete discovery of vulnerable wallets mean more losses are possible, and users should watch both official fixes and on-chain behavior.

Deep Dive

1. Scope Of The Coldcard Exploit

Galaxy Research and multiple outlets report that three attack waves have drained about 1,367 BTC from roughly 4,585 addresses, nearly 89 million dollars at recent prices, all tied to Coldcard-generated wallets with weak seeds.1

The root cause is a March 2021 firmware change that made some devices fall back to a predictable software random number generator when creating seed phrases, sharply reducing entropy and allowing attackers to brute-force keys offline.2

Mk2 and Mk3 devices on specific versions, plus older seeds on later models, are affected; Galaxys revised estimate of 1,367.05 BTC stolen replaces earlier lower figures as more addresses are linked to the flaw.2

Confidence: high because independent on-chain analyses and several major reports agree on the mechanism and loss range.

2. Impact On Users And Self-Custody

Most victims were long-term holders: drained coins had been dormant for roughly 3.23.5 years, consistent with cold storage behavior.3

Flows show a behavioral shift. One analysis notes sub 10 BTC deposits to exchanges spiking to 7,300 BTC in a day and sub 1 BTC transfers hitting 39,600 BTC, near FTX-collapse highs, as smaller holders move coins to perceived safety.4

Industry voices stress this is not a Bitcoin protocol failure, but a single wallet vendors bug. Many argue self-custody still works when diversified and properly configured, while others point to ETFs and institutional custodians as simpler options for less technical users.5

3. What To Watch Next

Coinkite has issued advisories and firmware hotfixes, but updating firmware does not fix already weak seeds; secure recovery requires generating new, strong seeds and migrating funds from vulnerable wallets.2

On-chain, stolen BTC largely remains unmoved in attacker-controlled addresses, suggesting either difficulty laundering such visible funds or a preference to wait until scrutiny fades.2

Analysts are still revising loss estimates and scanning for additional affected addresses, so the total may rise. For users, the key signals are new official security guidance from Coinkite, fresh sweep activity, and whether broader wallet vendors audit their own randomness paths in response.

Conclusion

The reported 89 million dollars in BTC thefts are the result of a specific Coldcard wallet entropy bug, not a failure of Bitcoin itself.

For crypto users, the incident underlines that cold does not automatically mean safe and that implementation details like randomness and seed creation are as critical as where you store the device.

As investigators continue to map affected wallets and vendors harden their tools, the main edge lies in staying ahead of security advisories and treating key-generation best practice as a first-class part of any Bitcoin custody strategy.