Coldcard wallet exploit losses near $89M

TLDR

A firmware flaw in Coldcard Bitcoin hardware wallets has been exploited to drain roughly $89 million from thousands of addresses, triggering an ongoing security and self custody shock.

1. Researchers estimate about 1,367 BTC, near $89 million, has been stolen across several attack waves targeting Coldcard wallets created with buggy firmware.
2. The bug made seed phrases partly predictable, impacting self custody users but not the Bitcoin protocol, and has driven unusual inflows of BTC back to exchanges.
3. The exploit is still being mapped, with legal risks for Coinkite and industry pressure for stronger hardware wallet testing and clearer user guidance.

Deep Dive

1. Scale And Mechanics Of The Exploit

Galaxy Research and others now track around 1,367 BTC stolen, worth about $88.689 million, across roughly 4,585 affected addresses in three main attack waves. Reports from Galaxy and Decrypt put observed losses at about $88.6 million and warn the exploit is ongoing.

The root cause is a March 2021 Coldcard firmware build that routed seed generation to a weaker software random number generator instead of the devices hardware randomizer, sharply reducing entropy and making recovery phrases guessable offline. Coinkites own postmortem and analysis summarized by TradingView note that this flaw allowed attackers to iterate over a bounded key space and systematically sweep vulnerable wallets.

Most stolen coins belonged to long term holders, with average dormancy over three years, according to Galaxys on chain analysis, which increases the psychological impact on users who believed they were following best practices.

2. Impact On Bitcoin And Self Custody

Importantly, this is not a Bitcoin protocol hack. Commentators like Anthony Pompliano stress that the incident reflects a third party hardware wallet failure, while Bitcoin itself remains cryptographically intact, as outlined in his explanation of the Coldcard attack.

The shock is instead hitting trust in self custody tooling. CoinDesk reports that small BTC holders have been moving coins back onto exchanges in volumes comparable to the post FTX period, reversing the usual not your keys, not your coins reflex and boosting balances on major venues such as Binance and Kraken. Some analysts, including a Bloomberg ETF specialist, argue in coverage of the incident that regulated spot Bitcoin ETFs may look more attractive to non technical investors after a high profile wallet failure.

3. What To Watch Next

Investigators are still tracing additional waves of theft and suspected attacker addresses, with on chain teams like Onchain Lens and Galaxy continuing to update loss estimates and victim counts. Some observers already discuss a possible fourth wave of attacks as remaining vulnerable seeds are enumerated.

Coinkite has released fixed firmware and paused shipments of affected devices, and victims are preparing potential class action litigation, according to reporting on threatened lawsuits over more than $88 million in losses. At the industry level, security leaders such as Krakens CSO are calling for independent, end to end testing of hardware wallet randomness and firmware to prevent similar multi year flaws from slipping through.

Conclusion

The Coldcard exploit is one of the largest hardware wallet failures in Bitcoin history, draining close to $89 million and shaking confidence in a core self custody tool. It has revealed that protocol level security is only as strong as the wallets and firmware people rely on, while also nudging some holders toward exchanges and ETFs for perceived safety. How quickly the industry tightens hardware wallet testing and how clearly vendors guide affected users will shape whether this episode becomes a one time shock or a lasting drag on self custody adoption.