Coldcard losses climb toward $114M

TLDR

A critical Coldcard hardware wallet bug has enabled attackers to sweep roughly $114 million in bitcoin from thousands of addresses, in multiple ongoing attack waves.

1. A firmware randomness flaw made Coldcard-generated seeds guessable, with on-chain analysts tracking about 1,816 BTC stolen from more than 5,200 addresses.
2. The incident is driving a spike in small-holder bitcoin transfers and renewed use of exchanges, while market sentiment and self-custody confidence take a clear hit.
3. A fourth sweep is still underway, and industry focus is shifting to emergency fixes, independent audits, and more robust multi-device or multisig custody setups.

Deep Dive

1. Bug And Losses

Reports from blockchain analysts and security researchers show that a Coldcard firmware bug introduced in March 2021 routed seed generation through a weak software random number generator instead of the hardware entropy source, dramatically reducing seed randomness and making keys guessable. Coverage from outlets such as The Defiant and Decrypt estimate that attackers have drained roughly 1,816 BTC, or about $114 million, across more than 5,200 Coldcard-generated addresses in four coordinated waves.

The latest wave uses Bitcoins replace-by-fee feature, meaning some theft transactions sit unconfirmed in the mempool for minutes, giving attentive users a narrow window to send their own higher-fee transactions and potentially save funds. Multisignature setups and seeds created with substantial external entropy (for example, long dice-roll sequences plus strong passphrases) are generally reported as less exposed to this specific RNG flaw.

2. Impact On Bitcoin And Users

On-chain data shows a sharp behavioral response. CryptoQuant data summarized by Decrypt notes that transfers under 1 BTC hit about 39,600 BTC in a single day, a level last seen right after FTX collapsed, and sub-10 BTC deposits to exchanges surged to multi-month highs as Coldcard news spread. This aligns with analysis that coins are moving from vulnerable wallets to exchanges or newly generated wallets, not just being sold.

Market-wise, bitcoin has been trading in the low $60,000s while futures yields have compressed, and several reports, including a CoinDesk daybook, flag the Coldcard exploit as a meaningful sentiment shock during an already cautious environment.

3. What To Watch Next

Coldcard maker Coinkite has halted shipments, released emergency firmware, and urged users to move funds to seeds generated under fixed firmware and stronger best practices, but lost coins are widely considered unrecoverable. Analysts expect remaining vulnerable wallets to be drained over time, especially if attackers continue to improve scanning and fee strategies.

Industry voices, including Krakens CSO and independent researchers, are now calling for independent entropy audits tied to specific firmware versions, public registries of tested hardware, and wider use of multi-vendor or multisig setups. AIs role in quickly finding the flaw, highlighted in reports like this analysis, is also pushing wallet teams to rethink how they test for subtle cryptographic weaknesses.

Conclusion

Coldcards entropy bug turned a trusted cold-storage tool into a single point of failure, enabling one of the largest hardware wallet thefts on record and pushing losses toward $114 million. The incident is not a Bitcoin protocol failure, but it is reshaping how users and institutions think about self-custody, nudging some toward exchanges and professional custodians and others toward more robust multisig and audited setups. What happens next in audits, legal liability, and user behavior will help show whether this is a temporary shock or a lasting shift in how large bitcoin holders store their coins.