Coldcard wallet exploit drains over 1,500 BTC

TLDR

A long standing Coldcard hardware wallet firmware bug has let attackers drain well over 1,500 BTC from users, making this one of the largest self custody breaches in Bitcoin history.

1. On chain research now puts confirmed losses around 1,600 BTC, with some analyses warning the total could approach 2,000 BTC as more vulnerable wallets are swept.
2. The exploit comes from a 2021 firmware change that weakened seed randomness on certain Coldcard models, allowing attackers to reconstruct private keys offline.
3. The incident is shaking trust in hardware self custody, driving coins back to exchanges and raising the odds of major legal and regulatory scrutiny of wallet makers.

Deep Dive

1. Scale And Timeline

Galaxy Research estimates about 1,596 BTC stolen so far, and projects that losses could reach roughly 2,055 BTC if all suspected waves are confirmed, putting the damage near 130 million dollars at recent prices. That aligns with separate reporting that now counts 1,816 BTC drained across more than 5,200 addresses after a fourth wave of attacks was detected. Together, these studies show that initial figures around 594 BTC were only the start and that confirmed losses have clearly moved beyond the 1,500 BTC mark.

Confidence: moderate because independent analyses differ on the exact total but agree that losses exceed 1,500 BTC.

2. Firmware Bug Mechanics

The root cause is a bug introduced in March 2021 that changed how some Coldcard devices generated wallet seeds. Instead of using a true hardware random number generator, affected firmware versions fell back to predictable software based values tied to chip data and timing, collapsing seed entropy from the intended 128 bits to roughly 40 to 72 bits on certain models. That made it feasible for attackers to precompute vulnerable keys, derive addresses, and drain funds without ever touching the physical wallet, as detailed in analyses of the Coldcard exploit.

Coldcard maker Coinkite has shipped patched firmware and advised that simply updating does not fix old weak seeds. Users who generated seeds on vulnerable versions without extra entropy or strong passphrases need to treat those wallets as compromised and follow the official migration guidance.

3. Impact And Next Signals

Sentiment data and on chain flow reports show extreme fear around self custody, with some measures of negative commentary surpassing past crises such as Mt. Gox and the 2020 crash, and smaller holders sending more BTC back to exchanges than at any point since early 2025. One study finds deposits under 10 BTC spiking and net flows to venues like Binance and Kraken increasing after the exploit, reversing the usual pattern where exchange failures drive coins off platforms and into hardware wallets. Legal pressure is also building, with victims preparing class action suits and commentators framing this as a potential precedent for hardware wallet product liability, as reported in coverage of Coinkite facing class action threats and exchange inflow analysis around the Coldcard exploit.

Conclusion

The Coldcard incident shows that even respected hardware wallets can hide critical bugs in their randomness and key generation, creating systemic risk for long term holders. While Bitcoin itself remains technically unaffected, the breach is reshaping attitudes to self custody, pushing some users back toward exchanges and putting wallet manufacturers under far closer legal and regulatory scrutiny. How quickly vulnerable users migrate and how authorities treat this case will go a long way toward defining future standards for hardware wallet security.