Coldcard Entropy Flaw Pushes 210,000 Bitcoin Out of Old Wallets as Losses Reach $116 Million

The fallout from the Coldcard hardware-wallet exploit disclosed on July 30 continues to move through Bitcoin's blockchain. Attackers drained roughly 1,816 bitcoin, worth about $116 million, from more than 5,200 addresses across four separate waves, and Galaxy Research has estimated total losses could reach $130 million once suspected additional waves are counted. The root cause was a build-configuration error in a Coldcard firmware release from 2021: instead of drawing randomness from the device's dedicated hardware random-number generator, affected units generated wallet seeds using a deterministic software pseudorandom generator, cutting effective entropy from the intended 128 bits down to as little as 40 bits on the oldest model and 72 bits on newer ones, low enough for a well-resourced attacker to brute-force the private keys.

CoinDesk reported that roughly 210,000 bitcoin has moved out of long-term holder wallets over the past week, a volume that likely reflects Coldcard users who were never directly stolen from rushing to migrate funds off the vulnerable firmware rather than a wave of ordinary selling. Because the flaw affects only wallets whose seeds were generated on the compromised firmware version, updating the device alone does not protect existing funds. Owners have to generate an entirely new seed and move their coins to a fresh wallet, a manual step that leaves any holder who has not yet acted still exposed.

Coldcard's maker has also temporarily suspended its automatic 120-day customer-data deletion policy, citing legal obligations tied to the ongoing incident, preserving records that would otherwise have been erased. Separately, Bitcoin Magazine reported that spot bitcoin exchange-traded fund inflows picked up following the disclosure, consistent with some self-custody holders opting to shift exposure into custodial, exchange-traded products rather than manage hardware-wallet risk themselves.