Coldcard exploit adds fourth BTC theft wave

TLDR

A critical Coldcard firmware bug has enabled a multi-wave Bitcoin wallet exploit, and a suspected fourth sweep is now draining hundreds more BTC from vulnerable users.

1. Four coordinated attack waves tied to a weak random-number generator in Coldcard firmware have stolen about 1,816 BTC, with a new cluster of suspicious sweeps now emerging.
2. This is the largest confirmed hardware wallet failure in Bitcoin history, pushing many holders out of self-custody and back toward exchanges and institutional custodians.
3. The exploit is not fully over, recovery odds are low, and the outcome will shape how hardware wallets and self-custody practices are audited and trusted going forward.

Deep Dive

1. Exploit Mechanics And Fourth Wave

Researchers traced the incident to a pseudo-random number generator bug in Coldcard firmware shipped since March 2021, which reduced seed entropy so private keys could be guessed by brute force instead of being truly random. Analysis of three confirmed attack waves shows 1,367.05 BTC stolen from 4,585 addresses, making this the largest hardware wallet hack by verified losses so far, with details documented in a technical writeup on the Coldcard PRNG vulnerability.

Galaxy Research and others now report a likely fourth wave. On-chain clustering points to roughly 388 to 449 BTC swept from hundreds of Coldcard-style addresses in a short window, matching the same vulnerable transaction pattern, though some victims have not yet directly confirmed their devices were affected in this round. Estimates put total losses near 1,816 BTC, or about 114 million dollars, according to a market analysis of Coldcard losses near 114 million.

2. Impact On Bitcoin Users And Self-Custody

The exploit attacks self-custody hardware rather than exchanges, which is why it has shaken confidence in the idea that offline devices are a near absolute safety anchor. One security overview notes that four coordinated waves have drained an estimated 1,816 BTC across 5,294 addresses, and warns that every vulnerable device is expected to be emptied over time if seeds were generated under the flawed firmware, as summarized in a Coldcard exploit crisis review.

On-chain flow data shows that since late July, net transfers of BTC from self-custody wallets to exchange addresses have turned positive each day, reversing a two year pattern where shocks like the FTX collapse pushed coins off exchanges instead. Small holders moved about 39,600 BTC in sub 1 BTC transfers on July 31 alone, a level last seen around the FTX event, according to analysis of the self-custody outflows spike.

3. What To Watch Next

Coldcards maker, Coinkite, has halted shipments of affected models and released patched firmware, but experts stress that updates only secure newly generated seeds, and do not fix keys that were already created with weak entropy, as explained in the Coldcard firmware bug report. Law enforcement has received lists of suspected attacker addresses, yet on-chain analysts like Willy Woo estimate only a 20 to 40 percent chance that any meaningful share of stolen BTC is recovered, and note that any process could take years, based on a Coldcard recovery outlook.

Short term, researchers are watching the mempool for replace by fee enabled sweeps from vulnerable addresses, which offer a brief window where victims might outbid attacker transactions before they confirm. Longer term, the industry is likely to tighten independent entropy audits for hardware wallets and emphasize multi component security so no single firmware bug can silently compromise long lived savings.

Conclusion

The new Coldcard theft wave deepens a hardware wallet failure that stems from flawed randomness, not from any weakness in Bitcoin itself. As more vulnerable seeds are identified and drained, the incident is pushing users to rethink how much trust they place in any single device or vendor, and is likely to drive stronger security standards and more diversified custody approaches across the Bitcoin ecosystem.