BTC cold wallet exploit hits $89M losses

TLDR

A critical flaw in Coldcard Bitcoin hardware wallets has enabled attackers to drain about $89 million from thousands of addresses, without compromising the Bitcoin network itself.

1. A March 2021 Coldcard firmware bug created predictable wallet seeds, letting attackers reproduce private keys and sweep about 1,367 BTC from roughly 4,500 addresses.
2. The incident is driving a self?custody rethink, with many affected and nervous users moving BTC onto exchanges and distorting usual on?chain and sentiment signals.
3. The exploit is still being worked through, so Coldcard users from the affected period must treat migration as urgent while the wider market watches for broader wallet audits and ETF narratives.

Deep Dive

1. What Was Exploited

Multiple reports show a vulnerability in a Coldcard firmware release from March 2021 that used weak, software?based randomness to generate seed phrases instead of the devices hardware random number generator. This made some seeds drawn from a finite, guessable key space.

Galaxy Research and others estimate three attack waves have swept about 1,367 BTC worth close to $89 million from around 4,585 Coldcard?generated addresses, with the latest wave targeting smaller balances and using more complex on?chain patterns, as detailed in the Coldcard cold?wallet attack summary.

Coinkite, Coldcards maker, has acknowledged the firmware bug and issued emergency updates, but crucially, updating firmware does not repair seeds that were already generated with insufficient randomness. Those wallets must be treated as compromised even if the device stays offline.

2. Impact On Users And Market

This is a wallet?layer failure, not a flaw in Bitcoin (BTC) itself. Attackers are reproducing keys offline and sweeping funds, yet the protocol and other hardware wallets with proper entropy remain intact.

At the user level, long?term holders relying on set and forget Coldcard storage have been hit hardest, with individual losses like 18 BTC in minutes and aggregate losses near $89 million, according to the wallet bug incident analysis.

On?chain, mass migrations and inflows to exchanges resemble selling: small BTC transfers and exchange deposits spiked to post?FTX highs, and bearish commentary surged. Analysts stress these flows mostly reflect emergency moves for safety, not a fundamental capitulation on Bitcoin.

3. What To Watch Next

Galaxy and other investigators say the exploit is still active, with the attacker systematically working through the vulnerable key space and average haul per wallet falling as high?value targets are exhausted. The exploit ballooning to around $88 million suggests more losses are possible if users do not act.

Coldcard users who generated single?signature wallets after the 2021 firmware release need to assume compromise and move funds to new, safely generated wallets or reputable custody, following Coinkites latest guidance.

More broadly, expect closer scrutiny of hardware wallet designs, calls for multi?vendor diversification, and a narrative push toward regulated BTC custody and spot ETFs, which some analysts argue look comparatively safer for non?technical holders after this incident.

Conclusion

The Coldcard exploit is a serious but contained event: it exposes weaknesses in one wallets seed generation and in naive self?custody practices, not in Bitcoin itself. For BTC holders, the key shift is from any hardware wallet is safe to a more nuanced view where entropy, firmware audits and diversification are part of basic risk management, and where large holders weigh institutional custody or ETFs against the operational burden of doing self?custody correctly.