Coldcard wallet flaw drives $100M BTC losses

TLDR

A firmware flaw in Coldcard Bitcoin hardware wallets let attackers guess wallet seeds, leading to over $100 million in stolen BTC while the Bitcoin network itself remained intact.

1. A 2021 Coldcard firmware bug weakened seed randomness, making thousands of wallets guessable and enabling thefts estimated at 1,596 to 2,055 BTC.
2. The incident is reshaping the debate around self-custody, with some analysts arguing it strengthens the case for institutional custody such as spot Bitcoin ETFs.
3. Affected users must migrate to new, securely generated wallets, and investigators are tracking most stolen coins on chain, making laundering difficult but not impossible.

Confidence: high because technical details and loss estimates align across multiple independent research and news sources.

Deep Dive

1. What Went Wrong

Coldcard wallets from Coinkite used flawed seed generation on several models and firmware versions starting in March 2021. Instead of using the hardware random number generator, vulnerable firmware relied on a deterministic MicroPython pseudo-random generator, sharply reducing entropy from the expected 128 bits to roughly 40 to 72 bits on affected devices, according to a detailed technical review.

Galaxy Research estimates that at least 1,596 BTC have been stolen across three confirmed attack waves, with a suspected fourth wave potentially lifting totals to about 2,055 BTC, nearly $130 million at recent prices, based on their loss analysis. Multiple reports put realized losses already above $100 million and still rising as more vulnerable wallets are found.

Importantly, this is a wallet firmware failure, not a break of Bitcoins cryptography. Only seeds created with the flawed Coldcard firmware are at risk; other wallets and the Bitcoin protocol remain unaffected.

2. Impact On Users And Market

Coldcard urged users to treat the issue as urgent, upgrade firmware, generate new seeds, and carefully move funds from Mk3, Mk4, Mk5 and Q devices, as described in its migration warning. Updating firmware alone does not secure old seeds; users must create new wallets.

The exploit has intensified the self-custody versus custodial debate. Galaxys findings have been used by ETF commentators to argue that institutional-grade custody is a feature, not a bug, with one analysis stating the Coldcard hack may be a strong bull case for spot Bitcoin ETFs that rely on regulated custodians, as discussed in this ETF custody piece.

Despite the scale of the theft, broader Bitcoin (BTC) price action has been relatively resilient, signaling that markets see this as a specific implementation failure rather than a protocol-level crisis.

3. What To Watch Next

Galaxy reports that around 90 percent of the stolen BTC remains unmoved, and attacker-controlled addresses have been shared with law enforcement and exchanges, according to their ongoing tracking update. Analysts note that visibility on Bitcoins public ledger makes large-scale laundering harder, though privacy tools, mixers and Lightning still present escape routes.

Users on affected devices are being advised to generate fresh, high-entropy seeds (often using physical dice) and migrate funds, with services like MARAs Slipstream offering private transaction submission to help victims move coins without telegraphing moves to attackers, as outlined in this Slipstream explainer.

Going forward, expect calls for independent audits of hardware wallet firmware and more scrutiny on entropy sources, as well as continued tension between fully self-managed keys and institutional custody solutions.

Conclusion

The Coldcard incident shows that self-custody security ultimately depends on wallet design and firmware quality, not just keeping keys offline. The flaw enabled attackers to turn weak randomness into large-scale theft, yet Bitcoins core protocol remains sound. For crypto users, the practical takeaway is to treat wallet selection, firmware audits and seed generation practices as first-class risks and to monitor how custody models and regulation evolve in response to this failure.