Coldcard Hack Tops $130M as Bitcoin Wallets Drained
A 2021 firmware flaw left thousands of Coldcard wallets with predictable seeds. Over $130 million in bitcoin is gone and at least 15 attackers are exploiting it.
The bug that shipped in 2021
Coinkite's Coldcard is the device Bitcoin maximalists point to when they argue self-custody beats any exchange. That reputation is now the story. A firmware build from March 2021 routed part of the seed generation through a weak software random-number generator instead of the device's dedicated hardware RNG. The result: predictable seeds, in some cases tied to values as trivial as a device's serial number. Specific Mk2 and Mk3 versions are exposed.
$70 million in 41 minutes
The first wave hit on 30 July — roughly 594 BTC, about $38 million. By 1 August the tally was 1,082 BTC; by 3 August it reached 1,367 BTC across 4,585 addresses, near $89 million. Galaxy Research now counts more than 2,055 BTC, over $130 million. One drain alone pulled $70 million in 41 minutes. Coinkite halted shipments and destroyed its remaining inventory.
One attacker became fifteen
What looked like a single coordinated actor didn't stay that way. At least 15 independent attackers are now working the same flaw, alongside smaller copycats. Any wallet that hasn't been migrated is fair game as long as coins sit on a vulnerable address. This is no post-mortem: the drain is still running.
The trade
Bitcoin is steady near $64,000, and that is the market reading the event correctly. This is a device failure, not a protocol failure. The chain is untouched; what broke was one vendor's key generation. The damage sits elsewhere. Cold storage was the clean answer to exchange risk and custodial risk. That answer just took a hit. For a slice of holders, the math now tilts toward regulated custody and ETF exposure, where the private key never sits with the user at all. The hardware-wallet business is carrying a reputational bill the market has yet to price.