Coldcard hack steals over 1,300 BTC

TLDR

A firmware bug in Coldcard hardware wallets has enabled attackers to steal over 1,300 BTC, making this one of the largest cold storage failures recorded.

1. Researchers estimate around 1,367 BTC, worth about 88 to 89 million dollars, has been drained across three attack waves from vulnerable Coldcard-generated wallets.
2. The root cause is a 2021 firmware flaw that produced weak seed phrases, undermining the core security promise of self-custody for affected Bitcoin holders.
3. The exploit is still active, with funds largely unmoved and victims exploring legal action, while users are urged to migrate from vulnerable setups and watch for further guidance and on-chain moves.

Deep Dive

1. Scale And Mechanics Of The Exploit

Galaxy Research and multiple outlets report that three coordinated attack waves have drained about 1,367 BTC from 4,585 Bitcoin addresses, with losses valued near 88.6 million dollars. Reports from Decrypt and Yahoo Finance note that the first major sweep on 30 July stole more than 1,083 BTC in under an hour, followed by smaller waves that targeted lower balance wallets and changed collection patterns for better obfuscation. The stolen coins remain parked in attacker-controlled addresses and have not yet been laundered, according to on-chain analyses referenced by Galaxy and Cryptoslate.

The technical issue traces back to a March 2021 Coldcard firmware build that routed seed generation to a predictable software random number generator instead of the devices hardware entropy source. This sharply reduced seed randomness, allowing attackers to brute force private keys offline for wallets created with the affected method, as detailed in coverage from TradingView and TheStreet.

2. Impact On Users And The Bitcoin Market

Victims include long term Bitcoin holders who followed best practices, such as keeping devices in safes and never exposing seed phrases, yet still lost entire balances in minutes, as illustrated in case studies from Yahoo Finance and TradingView. Many of the drained coins had multi year dormancy, highlighting that older holdings created during the vulnerable period are particularly exposed.

The incident has also distorted on-chain signals. Coindesk reports that small BTC deposits to exchanges spiked to levels last seen around the FTX collapse, as spooked users moved funds from self-custody back to venues like Binance and Coinbase for perceived safety. Analysts warn that these migration flows can look like selling pressure, even when holders are simply rotating custody rather than exiting positions.

3. Next Steps, Legal Fallout, And Risk Scope

Coinkite has issued emergency firmware updates, but security experts stress that updating does not fix seeds already generated with low entropy. Affected users need to create new wallets with strong randomness or dice based generation and move funds, while avoiding rushed mistakes or phishing. Coverage from Bitcoin.com notes that users who relied on dice rolls or added strong passphrases are generally not in the highest risk cohort.

On the legal side, victims are organizing potential class action suits against Coinkite, arguing product defects and negligence, while legal commentators are split on whether hardware wallet makers can be held liable for such failures. These cases could set important precedents for self-custody products. Meanwhile, investigators are monitoring attacker addresses and flagged patterns, and any large scale movement or laundering attempt would be a key next signal to watch.

Conclusion

The Coldcard hack shows that even respected hardware wallets can fail at the seed generation layer, turning offline and careful into still vulnerable for a specific slice of users. It is reshaping behavior as some Bitcoin holders temporarily favor perceived exchange safety over flawed self-custody, and it is likely to drive tighter scrutiny of wallet design, entropy guarantees, and vendor responsibility across the industry.