A serious firmware flaw in Coldcard hardware wallets has allowed attackers to reconstruct supposedly secret Bitcoin recovery seeds and drain thousands of addresses without stealing the physical devices.
Galaxy Research says it has high confidence that 1,596 Bitcoin was taken from about 7,300 addresses across three confirmed attack waves and 14 smaller incidents. At recent prices, the confirmed losses exceed $100 million. A suspected fourth wave could increase the total to approximately 2,055 Bitcoin, or nearly $130 million, although that additional activity has not yet received sufficient confirmation from individual victims.
The distinction matters because the investigation remains active and the totals are changing. What is already clear, however, is that storing a wallet offline cannot protect funds when the device creates a predictable secret key at the beginning.
The Attack Targeted Coldcard Wallet Seeds
A hardware wallet does not physically contain Bitcoin. The cryptocurrency remains recorded on the blockchain, while the device protects the private keys required to authorise transactions.
When a wallet is created, it normally generates a recovery seed represented by 12 or 24 words. That seed is effectively the master secret from which the wallet’s addresses and private keys can be reproduced.
A securely generated seed should contain enough randomness that guessing it would be computationally unrealistic. The Coldcard vulnerability weakened that randomness. Attackers could generate possible seeds on their own computers, calculate the corresponding Bitcoin addresses and compare those addresses with the public blockchain.
Once a match was found, the attacker possessed everything needed to sign a legitimate-looking transaction. No phishing message, stolen device, malicious browser extension or physical access to the wallet was necessarily required. Block’s technical analysis attributed the weakness to a firmware path that used a deterministic software pseudorandom number generator instead of the intended hardware random-number generator.
A Firmware Error Had Been Present Since 2021
The underlying problem reportedly began with a Coldcard firmware change released in March 2021.
During seed generation, affected firmware called a predictable fallback generator rather than obtaining the intended randomness from the STM32 hardware generator. Inputs such as device-specific information, timing state and earlier generator activity could reduce the number of combinations an attacker needed to test.
Coldcard manufacturer Coinkite says vulnerable Mk4, Mk5 and Q devices produced about 72 bits of entropy instead of the intended 128 bits. Earlier Mk2 and Mk3 implementations were reportedly weaker. Although 72 bits still sounds enormous, the reduction can make large-scale searching more realistic for a sophisticated and well-resourced attacker, particularly when wallet addresses are visible publicly.
The failure illustrates why a wallet can remain physically offline and still be remotely drained. The attacker did not need to communicate with the device after wallet creation. The vulnerability had already restricted the range of possible keys.
The Theft Expanded Through Multiple Waves
The incident initially appeared smaller than it ultimately became.
One early attack on July 30 swept 1,196 addresses in only 41 minutes, removing approximately 1,082.65 Bitcoin worth around $70 million at the time. Further groups of suspicious transactions were then discovered, pushing estimated losses to nearly $89 million across more than 4,500 addresses.
Galaxy Research’s August 3 update increased its high-confidence total to 1,596 Bitcoin across roughly 7,300 addresses. Its researchers also identified another coordinated pattern that could bring losses to 2,055 Bitcoin, but they have kept that suspected fourth wave separate because they have not received enough direct victim confirmation.
This explains why reports have quoted figures ranging from $70 million to $89 million, $116 million and nearly $130 million. The figures were calculated at different stages of an evolving investigation, sometimes using observed blockchain patterns and sometimes counting only losses supported by stronger victim evidence.
Installing the Update Does Not Repair an Existing Wallet
Coinkite has released fixed firmware for affected Coldcard models, but installing it does not make an existing vulnerable recovery seed secure.
The update corrects the process used to generate new seeds. It cannot add randomness to a seed that was created years earlier. Moving the same recovery words to another hardware wallet also provides no protection because the weakness belongs to the seed, not the physical Coldcard device.
Coinkite’s official security advisory instructs affected users to install the corrected firmware, create an entirely new seed and move the Bitcoin to addresses controlled by that new wallet. The company recommends verifying the new receiving address on the hardware screen and sending a small test transaction before transferring the remaining balance.
The company has also halted shipments and destroyed its remaining inventory containing vulnerable firmware. It says the corrected releases prevent the issue from affecting seeds created in the future.
Several Coldcard Models and Firmware Versions Are Affected
The advisory covers seeds generated on Mk2 and Mk3 devices running firmware versions 4.0.1 through 4.1.9. Mk4 and Mk5 seeds created before standard firmware 5.6.0 or Edge release 6.6.0X are also affected. For the Coldcard Q, vulnerable seeds include those generated before standard release 1.5.0Q or Edge release 6.6.0QX.
Coinkite says TAPSIGNER, OPENDIME and SATSCARD are not affected because they use different codebases.
Wallets created with at least 50 fair, independent and private dice rolls are not considered exposed by this particular random-number flaw alone. A strong, unique BIP-39 passphrase also creates an additional barrier, but Coinkite still recommends migration because neither protection repairs the underlying weak seed.
The decisive factor is the firmware used when the seed was originally generated. Installing safe firmware later does not retroactively change that history.
Most of the Stolen Bitcoin Has Not Moved
Galaxy Research reported that approximately 90% of the identified stolen Bitcoin remained unmoved. It also said all coins associated with the first three confirmed attack waves were still sitting in attacker-controlled addresses at the time of its update.
Because Bitcoin transactions are publicly visible, investigators can continue monitoring those addresses and provide them to exchanges, compliance firms and law-enforcement agencies. Galaxy says it has been sharing confirmed victim and attacker addresses with US federal authorities and industry investigators.
Traceability does not guarantee recovery. An attacker may divide the funds among additional addresses, exchange them through poorly controlled services or use other methods to complicate attribution. An exchange can potentially freeze identifiable deposits, but Bitcoin transactions cannot simply be reversed by the network.
The Incident Does Not Mean Every Hardware Wallet Is Unsafe
Hardware wallets still reduce major risks by isolating private keys from ordinary internet-connected computers. They can protect against malware that searches a laptop for wallet files and against websites attempting to access signing credentials.
The Coldcard incident demonstrates that offline storage is only as secure as the complete system creating and managing the keys. Firmware, random-number generation, backup procedures, supply-chain integrity and user verification all remain important.
It also exposes the limits of treating “open source” as an automatic guarantee of safety. Publicly available code can be reviewed by independent researchers, but a vulnerability may remain unnoticed for years when nobody examines the relevant execution path closely enough. Open code enables verification; it does not ensure that verification has occurred.
More resilient arrangements may use multiple independently generated keys, different devices or collaborative multisignature custody. Such setups can prevent one compromised seed from authorising a transaction alone, although they introduce greater operational complexity and their own recovery risks.
Rushed Migration Can Create a Second Disaster
Affected owners face legitimate urgency, but moving cryptocurrency carelessly can cause additional losses.
The replacement seed must be generated only after verified fixed firmware is installed. The new recovery words should never be entered into a website, shared with someone claiming to represent customer support, photographed or stored in an unprotected online account.
Coinkite specifically advises confirming the wallet fingerprint and receiving address, completing a small test transfer and checking that it arrived before moving the remaining balance. It also recommends retaining the old backup until the entire migration has been confirmed.
The manufacturer warns that panic can create a more immediate threat than the vulnerability itself. One incorrect address, lost seed or unverified firmware download can make a transfer permanently unrecoverable.
Cold Storage Is Not the Same as Guaranteed Security
The Coldcard exploit is damaging because it defeated the assumption at the centre of hardware-wallet security: a secret generated offline should be unreachable to a remote attacker.
The devices did keep their keys away from the internet. The problem was that some of those keys were never unpredictable enough. Once attackers reconstructed them, the blockchain accepted their transactions exactly as it would accept a transfer authorised by the legitimate owner.
Confirmed losses already exceed $100 million, while the potential total is approaching $130 million. Whether the suspected fourth wave is fully verified or not, the incident has become one of the clearest warnings that self-custody does not eliminate trust. It transfers trust from an exchange to firmware, hardware, key-generation procedures and the owner’s ability to operate them safely.
