A security flaw in Coldcard hardware wallets has escalated into one of the largest Bitcoin wallet compromises on record, with confirmed losses now exceeding $100 million across three coordinated attack waves. Security researchers at Galaxy reported that attackers exploited a firmware vulnerability affecting wallet seed generation, allowing them to systematically identify and drain vulnerable Bitcoin wallets.
The first wave of attacks struck on July 30, when hackers emptied more than 1,000 wallets in less than an hour. Subsequent attack waves pushed the total losses beyond the $100 million mark as additional compromised wallets were identified and emptied. The attackers primarily targeted wallets generated using affected firmware versions dating back several years, highlighting the long-term risks of cryptographic implementation flaws.
How the Vulnerability Worked
According to Galaxy’s analysis, the issue originated from a flaw in Coldcard’s random number generation process used to create wallet recovery seeds. Instead of producing sufficiently unpredictable seed phrases, vulnerable firmware generated entropy that attackers could feasibly reconstruct with significant computing re
As a result, hackers were able to derive private keys without phishing victims, installing malware, or gaining physical access to the hardware devices. Researchers said this made the incident particularly severe because it undermined one of the core security assumptions behind hardware wallets.
The incident affected multiple generations of Coldcard devices that created wallets using the flawed firmware. However, wallets generated with updated firmware and newly created seed phrases are not believed to be vulnerable.
Industry Response
Coldcard manufacturer Coinkite acknowledged the vulnerability and released firmware updates while urging affected users to immediately migrate funds to wallets created with fresh recovery phrases. Simply updating the device does not secure wallets that were originally generated using vulnerable firmware, since the compromised seed phrase remains at risk.
The breach has renewed debate over hardware wallet security and software auditing within the cryptocurrency industry. Although hardware wallets remain one of the safest methods for self-custody, the incident demonstrates that implementation bugs can have catastrophic consequences when they affect key generation.
Security experts continue to monitor blockchain activity for additional thefts, warning that more vulnerable wallets could still be at risk if users have not yet migrated their funds.
