Coldcard wallet exploit drains $88M BTC

TLDR

A critical software bug in Coldcard Bitcoin hardware wallets has enabled attackers to drain at least 1,367 BTC, roughly 88 to 89 million dollars, from thousands of users.

1. A seed-generation vulnerability in Coldcard firmware let attackers guess private keys, leading to multi?wave drains of at least 1,367 BTC, while the Bitcoin protocol itself remains intact.
2. The exploit is shaking confidence in self?custody, pushing more BTC back to exchanges and prompting calls for independent security audits of hardware wallets.
3. Further attack waves, legal action against Coldcards maker Coinkite, and industry changes in how wallets are tested and audited are the key things to watch next.

Deep Dive

1. How The Exploit Worked And Its Scale

Security researchers traced the incident to a pseudo?random number generator bug in Coldcard firmware introduced around March 2021, which produced seed phrases with far less randomness than intended for some models. This low?entropy seed generation made it feasible for attackers to brute?force recovery phrases and reconstruct private keys without touching the devices or tricking users, as detailed in analyses of the PRNG vulnerability in Coldcard firmware.

On?chain mapping by Galaxy Research and others shows at least 1,367.05 BTC, about 88.6 million dollars, drained across roughly 4,585 addresses in several coordinated waves of attacks, with later reports suggesting a fourth wave and higher potential totals as more wallets are identified. Importantly, this is a failure of a hardware wallet implementation, not a flaw in Bitcoins network, a distinction emphasized in explanations that Bitcoin itself was not hacked.

2. Impact On Self?Custody And The Market

Coldcard is a Bitcoin?only device used by many serious long?term holders, so this incident directly hits the narrative that cold storage is inherently safer than custodial solutions. Researchers note that most affected addresses held less than 1 BTC, but large individual wallets account for most of the stolen value, pointing to widespread self?custody among retail and high?net?worth users rather than just institutions, according to Galaxy researchers.

Unlike the FTX collapse period, when BTC flowed off exchanges into hardware wallets, the Coldcard crisis is producing the opposite effect, with net transfers from self?custody back to exchange addresses turning positive each day since late July in on?chain flow studies of self?custody flows reversing. That short?term shift, plus negative sentiment, has added selling pressure in an already cautious market.

3. Response, Liability And What To Watch

Coinkite has halted shipments, destroyed remaining units with vulnerable firmware and released patched versions, but updates cannot fix seeds that were already generated with weak randomness; affected users must create new seeds and migrate funds, according to coverage of Coinkites response and Kraken CSOs audit call.

Victims are preparing potential class?action lawsuits, and legal commentators see this as an early test case for product liability in crypto hardware, as noted in reports that Coinkite faces class action threat. At an industry level, security experts now argue that seed generation should be independently tested and audited, not left solely to manufacturers internal checks.

Conclusion

The Coldcard exploit shows that self?custody risk is not just about phishing or exchange collapses but also about subtle bugs in key?generation code that can persist for years. The incident has drained tens of millions of dollars in Bitcoin, temporarily pushed holders back toward exchanges, and exposed how much trust users place in hardware wallet vendors. The next phase will reveal whether legal pressure and community scrutiny translate into stronger, independently verified security standards for all major wallets.