Coldcard Cold-Wallet Theft Nears $89 Million as a Five-Year-Old Firmware Bug Reproduces Users' Keys

An attacker has drained roughly 1,367 bitcoin, worth close to $89 million at current prices, from about 4,585 Coldcard hardware wallets, according to CoinDesk's account of Galaxy Research's on-chain mapping. The loss started at $38 million late last month and has since moved through three separate rounds. The most recent round targeted smaller balances and used more complex transaction patterns to collect the funds.

The root cause is not a broken chip or a stolen recovery phrase. A firmware integration error shipped in March 2021 routed seed generation on affected Coldcard devices to a deterministic software pseudorandom number generator instead of the STM32 chip's hardware random number generator. Because the software fallback was seeded from fixed factory metadata and predictable clock values, an attacker could reconstruct the private keys off-chain without ever touching a victim's device, seed card, or computer. Every drained wallet used a single signature and held more than roughly 0.15 bitcoin, and the affected coins span 2021 through 2026, which matches the age of the flaw.

Coinkite, Coldcard's maker, has released fixed firmware and urged users to move funds to newly generated wallets. The company's founder, who goes by NVK, said that code review assisted by artificial intelligence can now find hidden bugs faster than experienced human auditors, and that the same kind of tooling may have helped whoever found this one. Watcher Guru put the running total above $88 million before the third round pushed it higher.

The neutral read is that this is a failure of the randomness used to create the keys, not a compromise of the secure-element hardware. That distinction matters for who is exposed. The certified hardware operated correctly. The bug was in how the software requested randomness, which means no amount of physical tamper resistance would have protected a key that was predictable from the moment it was created.