Coldcard exploit losses hit $114M BTC

TLDR

Losses from a critical Coldcard hardware wallet exploit are now estimated around $114 million in Bitcoin, after multiple attack waves against vulnerable addresses.

1. Researchers have tracked roughly 1,800 BTC drained across four attack waves, with total losses near $114 million but some fourth?wave victims still only pattern?identified.
2. A March 2021 firmware bug weakened seed phrase randomness on Coldcard devices, letting attackers brute?force private keys on many single?signature wallets.
3. The incident is driving BTC from self?custody back to exchanges and custodians, and further waves or copycat exploits remain possible until weak seeds are fully migrated.

Deep Dive

1. Scale Of The Losses

Galaxy Research initially mapped three waves of Coldcard?linked theft totaling about 1,367 BTC, or roughly $88.6 million at recent prices, across 4,585 addresses, mostly individual self?custody wallets. Reports on a fourth sweep suggest the attacker has now moved around 1,816 BTC in total, lifting estimated losses to near $114 million, as detailed in Coldcard wallet losses may near $114 million and Coldcard losses near $114M.

The $114 million figure is partly based on on?chain pattern matching rather than direct victim confirmation for every address, so it is best treated as an informed estimate rather than a final, audited total.

Confidence: moderate. Loss ranges are consistent across several independent researchers, but attribution of some fourth?wave addresses remains probabilistic.

2. How The Exploit Works

Coldcard maker Coinkite shipped firmware in March 2021 that accidentally disabled the hardware random number generator and routed seed creation to a deterministic software fallback. That reduced seed entropy from the intended 128 bits to about 40 bits on some Mk3 devices and roughly 72 bits on newer models, as explained in Bitcoin was not hacked in Coldcard attack and other technical breakdowns.

With weaker randomness, attackers could precompute or search the key space and systematically sweep funds from affected Coldcard?generated addresses. The pattern so far points mainly to single?signature wallets created on vulnerable firmware; multisig setups and seeds generated with strong external entropy, such as extensive dice rolls plus robust BIP?39 passphrases, are much less exposed. Importantly, this is a failure of a hardware wallet implementation, not of the Bitcoin protocol itself.

3. Market Impact And What To Watch

The exploit is reshaping custody behavior. CryptoQuant data show small holders shifted about 39,600 BTC in sub?1 BTC transactions on one day, with exchange deposits in the sub?10 BTC band spiking to 7,300 BTC, a move widely linked to Coldcard fear in Coldcard losses near $114M. Separate coverage notes that unlike the FTX collapse, this time BTC is flowing from self?custody back to exchanges and institutional custodians, as in Coldcard pushes bitcoin back to exchanges.

New waves of sweeps could appear until all vulnerable seeds are migrated. The latest attacks sometimes use Bitcoins replace?by?fee feature, briefly allowing victims who spot pending siphon transactions in the mempool to outbid the attacker on fees and rescue funds.

Conclusion

The Coldcard incident is a large, ongoing self?custody failure, with losses plausibly around $114 million in BTC driven by a subtle firmware bug rather than protocol weakness. It is already shifting behavior toward more conservative custody choices and forcing a re?evaluation of hardware wallet design, entropy auditing, and multisig practices. The main things to watch now are further attack waves, industry responses on independent security testing, and whether shaken confidence in self?custody stabilizes once vulnerable seeds are fully migrated.