Coldcard Wallet Flaw From 2021 Lets Attacker Drain $89 Million in Bitcoin Without Touching a Device

The attack required no access to any physical device, which makes it a notable example of how self-custody can fail. According to Galaxy Research, relayed by CoinDesk, a March 2021 firmware integration error in Coldcard hardware wallets routed seed generation to a deterministic software pseudorandom number generator (PRNG) rather than the device's STM32 hardware random-number generator (RNG). The result was private keys built from far less randomness (less entropy) than their owners believed.

The root cause is a cryptographic implementation defect, not a smart-contract or exchange failure. Because the flawed randomness depended on a constrained set of inputs (the device identifier, timer state, and prior RNG-call history), an attacker who can reconstruct those conditions can regenerate candidate seeds offline, derive their addresses, and check them against the public ledger. No recovery phrase, computer, or physical access is required. Every coin taken so far was held in an address created after the vulnerable firmware shipped on March 17, 2021.

The losses have grown across successive waves. crypto.news reports that a fourth suspected wave moved 448.7 BTC from 709 addresses, with some transactions still potentially replaceable. Alex Thorn of Galaxy Research warned publicly that the newest wave was underway and urged owners of affected devices to move their funds immediately. In total the sweeps have reached roughly 1,367 BTC, close to $89 million at bitcoin's level near $63,000, across 4,585 addresses.

Two details stand out. First, the stolen bitcoin remains unspent, which is unusual for a theft of this scale. That is consistent either with an operator waiting for scrutiny to fade or with one who lacks a way to launder so visible a sum. Second, as CoinDesk noted separately, smaller holders are now moving coins back onto exchanges for safety, the reverse of the shift into self-custody that followed the 2022 FTX collapse.