Coldcard Key-Generation Flaw Pushes Bitcoin Losses Past $130 Million

The theft began with a single 25-minute transfer of 594 bitcoin. It has since become one of the largest self-custody failures recorded in the Bitcoin ecosystem. Blockchain monitoring firms now put total losses above $130 million, up from the roughly $89 million counted across about 4,500 addresses earlier this week.

The root cause is not a smart contract and not a compromised exchange. A firmware release shipped in March 2021 by Coinkite, the Canadian manufacturer of the Coldcard hardware wallet, let affected devices skip the dedicated hardware randomness generator. Those devices fell back to software key generation seeded with non-secret chip data, including device serial numbers. Anyone who reconstructed that fallback could recompute the seed phrases and spend the coins. The devices never had to be connected to the internet, which is precisely the property owners bought them for. Coinkite has published fixed firmware, and the warning circulating on Bitcointalk tells holders to update, generate a new seed, and move funds, in that order.

Two consequences arrived on Wednesday. Bitcoin Magazine reported that close to $32 million of bitcoin moved for the first time in 12 years, a category of dormant supply that had been treated as effectively lost. The address holding roughly $36 million of the stolen coins has filled with messages paid for by victims asking for partial returns and by strangers advertising to the attacker. The public ledger that recorded the theft now also records those appeals.

The industry argument that follows is about what self-custody actually protects against. Bitcoin Magazine's response is that abandoning personal key management would abandon the point of the asset, and that the historical lesson is not to trust custodians instead. CryptoSlate's counter-argument is narrower and harder to dismiss. Offline keys still depend on entropy, firmware, signing logic, and recovery paths, all written by fallible people, which makes software quality a more immediate threat than quantum computing. Both positions accept the same fact. The failure was in an implementation, not in the protocol.