Coldcard wallet exploit drains 1,367 BTC

TLDR

A critical firmware bug in Coldcard Bitcoin hardware wallets was exploited remotely, draining about 1,367 BTC, making this one of the largest hardware wallet failures in crypto history.

1. Attackers abused a weak random number generator in Coldcard firmware, letting them reconstruct seed phrases and steal roughly 1,367 BTC from about 4,585 addresses.
2. The exploit hit self custody confidence and shifted BTC back toward exchanges and ETFs, but the Bitcoin protocol itself was not hacked.
3. Coldcard has patched firmware and halted vulnerable shipments, while researchers warn ongoing attack waves, so users should follow official guidance and monitor on chain flows.

Deep Dive

1. How The Exploit Drained 1,367 BTC

Galaxy Research and multiple outlets report that a pseudo random number generator flaw introduced in March 2021 firmware left Coldcard seeds far less random, with effective entropy collapsed to around 40 to 72 bits instead of the intended 128 bits. This made certain BIP 39 recovery phrases mathematically guessable rather than practically unbreakable.PRNG vulnerability summary

By iterating through that reduced seed space, attackers could reconstruct private keys from public information such as device serials and timing and drain wallets without touching devices or tricking users. Galaxy tracks about 1,367.05 BTC stolen from 4,585 addresses, in several coordinated waves that emptied hundreds of dormant wallets within minutes.

Crucially, this was a failure in Coldcards key generation code, not a breach of Bitcoins consensus rules or cryptography. As Anthony Pompliano stressed, Bitcoin itself remains secure at the protocol level.Protocol clarification

2. Impact On Bitcoin Users And The Market

Coldcard is a respected Bitcoin only hardware wallet, so a deterministic seed flaw has shaken confidence in cold storage as a near absolute safety standard. Institutions and high net worth users lost tens of millions of dollars, and some researchers warn every vulnerable single signature wallet may eventually be swept if funds are not moved.Scope of losses

On chain data shows a surge in small BTC transfers and movements back to exchanges after the hack, the largest sub 1 BTC activity since the FTX collapse, as users reposition away from a specific hardware risk toward custodial or ETF solutions.Exchange flow shift

3. Coldcards Response And What To Watch

Coinkite, Coldcards maker, has confirmed the entropy issue, shipped patched firmware, halted shipments of affected models, and destroyed remaining vulnerable units in stock, while urging customers to migrate to seeds generated on fixed software.Company response

However, patched firmware only protects new seeds. Old seeds created on flawed versions remain weak, and Galaxys research plus independent analysts continue to flag a possible fourth wave of attacks with pending transactions that victims can still outbid using replace by fee before confirmation.Wave four details

For users, the key signals to monitor are fresh advisories from Coldcard and security researchers, on chain dashboards tracking exploit addresses, and whether the drained BTC starts moving toward mixers or exchanges, which would mark the next phase of the attackers strategy.

Conclusion

The Coldcard incident shows that even highly regarded hardware wallets can fail if their randomness and seed generation are implemented incorrectly, turning cold storage into an exploitable pattern. The Bitcoin network did not break, but a firmware bug created a large, ongoing loss event that is reshaping how holders think about self custody versus custodial solutions. Watching how quickly vulnerable users rotate seeds and where the stolen BTC eventually moves will help gauge both the final damage and the lasting impact on hardware wallet trust.