Coldcard BTC exploit drains 1,367 BTC

TLDR

A firmware flaw in Coldcard Bitcoin hardware wallets has enabled attackers to regenerate private keys and drain about 1,367 BTC, making this one of the largest hardware wallet hacks to date.

1. The exploit targets weak seed generation in specific Coldcard firmware, with on?chain analysts tracking roughly 1,367 BTC stolen across several attack waves.
2. The incident hits self?custody hard because victims often followed best practices; the failure is in wallet entropy, not user behavior or the Bitcoin protocol.
3. Next, users should watch for further attack waves, Coldcard and research firm updates, and broader hardware wallet security audits that could reshape self?custody practices.

Deep Dive

1. Exploit Scale And Mechanics

Galaxy Research and others report that compromised Coldcard wallets have lost about 1,367 BTC, roughly 86 to 89 million dollars depending on price, across at least three confirmed attack waves tracked on chain. Reports from Galaxy and Decrypt describe sweeps of hundreds of BTC at a time, with funds consolidated into attacker?controlled addresses and remaining largely unspent so far.

The root cause is a March 2021 firmware build error that broke Coldcards random number generation for seed phrases. Instead of using the hardware true random generator, affected devices fell back to a predictable software RNG, shrinking effective seed entropy from the intended 128 bits to roughly 40 to 72 bits on some models. That made it computationally feasible for attackers to brute?force seed phrases offline and systematically drain wallets created with the vulnerable firmware, as detailed in Galaxys analysis and a technical write?up on Coldcards PRNG vulnerability.

2. Impact On Bitcoin Users And Self?Custody

Many victims were long?term holders whose coins sat untouched for years, and some kept devices in bank safety deposit boxes, never connected to the internet, yet still lost funds once their seeds were guessed. Coverage from Galaxy and Decrypt highlights dormancy averages over three years, and individual cases losing tens of BTC in minutes despite textbook self?custody behavior.

Because the exploit required no phishing or obvious user mistake, it undermines the perceived safety of cold storage and shifts scrutiny to firmware and entropy quality. Analysts note that this is now the largest confirmed hardware wallet hack by value, and commentaries from industry figures argue that some less technical users may gravitate toward custodial solutions or Bitcoin ETFs after seeing that even offline devices can fail when seed generation is flawed.

3. What To Watch Next

Coinkite, the maker of Coldcard, has shipped patched firmware, halted shipments of vulnerable units, and reportedly destroyed remaining stock of affected devices, while urging users to migrate funds off seeds generated on the bad firmware. Galaxy Research continues to publish updated loss estimates and attacker address sets, and on?chain analysts are monitoring a possible fourth wave of attacks that could push totals higher.

Beyond this specific incident, hardware wallet providers and auditors are likely to face pressure for deeper reviews of RNG implementations, reproducibility guarantees, and better disclosure when entropy assumptions change. For Bitcoin holders, key signals to monitor are: any new advisories from Coldcard, changes in self?custody versus ETF or exchange usage, and whether other wallet vendors announce entropy?related patches in response.

Conclusion

The Coldcard exploit is a firmware?level entropy failure that has already drained about 1,367 BTC and shaken confidence in hardware wallets, even among careful self?custody users. Bitcoin itself remains cryptographically intact, but this episode shows that wallet seed generation is a critical, sometimes under?audited link in the security chain. How quickly vendors harden their RNG implementations, and how users adapt their custody choices, will determine whether this remains a Coldcard?specific saga or catalyzes a broader shift in Bitcoin storage practices.