Coldcard attack spreads

TLDR

A long dormant bug in Coldcard Bitcoin hardware wallets is now being actively exploited, draining funds from vulnerable wallets in multiple waves.

1. A firmware error in Coldcards seed generation has enabled attackers to brute?force private keys, with three documented waves stealing around 1,367 BTC.
2. The incident is pushing many affected and non?affected holders to move Bitcoin back to exchanges, hitting self?custody sentiment but remaining specific to Coldcards flawed firmware.
3. The attack is still live; anyone who ever generated a Coldcard seed on vulnerable versions faces elevated risk and should watch for official guidance and migration options.

Deep Dive

1. Attack Mechanics And Scale

Researchers attribute the exploit to a March 2021 Coldcard firmware change that accidentally used a predictable software randomizer instead of the wallets hardware random number generator to create seed phrases. This reduced seed entropy and left a finite, computable keyspace that attackers can search offline without touching the device itself, as detailed in a Binance News report on three attack waves draining 1,367 BTC.

Galaxy Research and other analysts now track roughly 1,367 BTC, about 88 to 89 million dollars, stolen from 4,585 addresses across these waves, with later activity targeting smaller balances and using more fragmented collection patterns. Coverage from CryptoSlate describes the bug as a wallet flaw that has produced three suspected attack waves and confirms that the stolen coins remain in attacker controlled addresses.

Confidence: high, because multiple independent on chain analyses and media reports converge on similar loss totals and root cause.

2. Impact On Bitcoin Custody And Flows

Unlike exchange failures such as FTX, this incident hits self?custody directly. Coindesk reports that small Bitcoin deposits to exchanges surged, with transfers under 1 BTC reaching 39,600 BTC in a day and net inflows of 11,163 BTC, as investors reacted to the Coldcard exploit and moved coins back to venues.

On chain, this looks like heavy selling, but much of the movement is migration rather than outright liquidation, which temporarily distorts usual holder behavior signals. Sentiment around Bitcoin self?custody is understandably shaken, yet the flaw is specific to Coldcard devices running the affected firmware and does not reflect a protocol level weakness in Bitcoin or in all hardware wallets.

3. Risks For Users And What To Watch

Coldcards maker Coinkite has issued emergency firmware updates and security notices, but investigators stress that patches only protect seeds created after updating; any seed generated with weak randomness remains vulnerable, as highlighted in Bitcoin.coms summary of Coinkites long dormant firmware flaw and ongoing thefts.

Security researchers advise treating single signature wallets created on affected Coldcard firmware as at risk until funds are migrated to keys generated with strong entropy, often on a different or updated device. Many also advocate diversified setups such as multisig across multiple vendors and use of a passphrase layer, so a single implementation bug cannot compromise an entire stack. Watching for: further official Coldcard guidance, any new waves of on chain drains, and clear lists of impacted versions so users can assess their exposure.

Conclusion

The spreading Coldcard exploit shows that even respected hardware wallets can fail when entropy and seed generation are mishandled, turning offline storage into a computable target. For Bitcoin users, the key is separating protocol trust from implementation trust and treating wallet firmware, seed creation methods, and diversification across devices as live security parameters to monitor, not one time choices.