Hardware Wallets Pulled a Fast One: Coldcard Bug Drains $70M in BTC While CZ Shrugs 🧊

Changpeng "CZ" Zhao is urging crypto holders to rethink blind trust in hardware wallets after an exploit on Coldcard devices siphoned roughly $70.2 million in Bitcoin in a 41-minute window on July 30. In a Saturday post on X, the Binance founder cautioned that even hardware wallets can carry bugs and that older devices with long histories are not immune. "Nothing is 100%," Zhao wrote, advising holders to spread funds across multiple wallets while acknowledging the approach carries trade-offs. He closed with his familiar refrain, "Stay SAFU!"

The vulnerability traces to a build error in Coldcard hardware, made by manufacturer Coinkite. Affected units drew seeds from a software fallback rather than the device's hardware random-number generator, leaving private keys far easier to guess than intended. The flaw originated in firmware shipped in March 2021, and updating the firmware does not repair a seed already generated on a compromised device. Coinkite has shipped emergency hotfixes and urged exposed users to migrate to newly generated seeds.

According to Galaxy Research, which mapped the flow of funds based on a pattern identified by engineers at Block, 1,196 addresses were drained for about 1,082.65 BTC, or roughly $70.2 million, between 01:10:20 and 01:51:26 UTC on July 30. That figure nearly doubles earlier estimates of approximately 594 BTC, or around $38 million, from about 500 wallets. Galaxy noted every sweep paid an identical hardcoded fee and left no change output, a signature it described as consistent with an automated tool spending keys it already held rather than owners moving their own funds. Victims spanned native SegWit and older address types, pointing to multi-path key scanning. The stolen $BTC was consolidated within minutes into a handful of addresses and, per Galaxy, has not moved since.