Coldcard Seed-Generation Flaw Pushes Bitcoin Losses Above $114 Million as Sweeps Continue

The theft from bitcoin addresses created by Coldcard hardware wallets is continuing. Bitcoin Magazine puts the running total above $114 million, and Watcher Guru reported the figure passing $100 million late on Monday. Estimates differ by counting method and by the hour. Galaxy Research, which mapped the drains, counted 1,367 BTC worth about $88.6 million across 4,585 addresses in its confirmed set. By contrast, Fortune reported roughly 1,816 BTC, close to $116 million, already moved off affected wallets. The first set of drains on 30 July emptied 1,196 addresses in 41 minutes.

The root cause is a failure of randomness, not a defect in bitcoin itself. According to Galaxy's analysis, a firmware integration error introduced in March 2021 routed recovery-seed generation to a deterministic software pseudorandom number generator instead of the hardware random number generator on the device's STM32 chip. An attacker who can narrow down the device identifier, the timer state and prior generator calls can reproduce candidate key streams offline, derive the resulting addresses and match them against the public ledger. No physical access to any device was required.

Coinkite, the Canadian manufacturer, has published patched firmware, halted shipments and destroyed the remaining affected stock. It is telling users to move funds to newly generated seeds immediately. Migration is the only remedy, because the device alone cannot show its owner that a seed was safely generated.

A second effect is now visible on-chain. CoinDesk reports a wallet dormant since 2013 moved $31 million on Monday, part of a wider set of old coins in motion since the hack. Some of that is precautionary migration by holders who cannot rule out exposure. Some of it is the attackers. Block data alone cannot separate the two in real time.