Coldcard Catastrophe Tops $100M: Hardware Wallets Hand Out 'Not Your Keys, Not Your Coins' Irony 🥲

Confirmed losses from the Coldcard wallet incident have surpassed $100 million, with 1,596 $BTC stolen from roughly 7,300 addresses across three confirmed attack waves and 14 smaller incidents, according to Galaxy Research. The research arm of Galaxy Digital said Monday that 73 victims have contacted its researchers, and victim reports have verified the first three major attacks, helping investigators identify smaller "footprints" that Galaxy said could represent opportunistic attackers exploiting the same vulnerability. Galaxy also flagged a suspected fourth wave that could push total losses to 2,055 $BTC, worth about $130 million, though it excluded that event from its confirmed figure pending victim verification.

The flaw stems from a March 2021 firmware build error at Coinkite that routed random-number generation through a deterministic MicroPython fallback instead of the intended hardware source. Block's Bitcoin engineering team found that Mk2 and Mk3 devices on vulnerable firmware added no cryptographic entropy through that path, while later models used a limited secure-element reseed. Coinkite's security advisory covers Mk2 and Mk3 firmware versions 4.0.1 through 4.1.9, plus seeds generated on Mk4, Mk5 and Q devices before their fixed releases. Coinkite co-founder Rodolfo Novak said on X that the company takes responsibility for the firmware bug and has released a hotfix to remove the software fallback path, but warned that updating software does not repair seeds created earlier and advised affected users to move funds to a new seed.

Initial on-chain analysis by AnchorWatch CEO and co-founder Rob Hamilton estimated 594.48 $BTC, worth around $38 million, moving across 500 transactions within a three-block window. Galaxy Research later traced the Bitcoin movements between 1:10 AM and 1:51 AM UTC on July 30 across blocks 960,183 to 960,191, about 30 hours before Coldcard published its first security advisory, and identified 1,196 addresses linked to 1,082.65 $BTC, worth about $70.2 million at the time. Galaxy then logged a third wave that removed 207.7294 $BTC from 1,912 addresses, lifting its observed tally to 1,367.05 $BTC across 4,585 addresses. A subsequent flagged wave across 15 consecutive blocks ran at roughly 45 times the normal rate, with 218 transactions impacting 462 potential victim addresses and moving around 388.9 $BTC, and after correcting a set that had wrongly included multisig addresses, Galaxy put that wave at 709 addresses and 448.73 $BTC, about $28 million.

Galaxy's head of research Alex Thorn has continued to document the activity, writing on X that "I continue to investigate and add new Coldcard victim and attacker addresses to our investigation database" and warning that "The attack is ongoing—move your funds off Coldcard-generated addresses immediately if you have not done so." Thorn wrote that the sweeps look deliberate and programmatic, possibly orchestrated with a large language model, and cautioned that every single-sig Coldcard address created after that 2021 update will eventually be drained. The stolen coins had sat untouched for an average of 3.18 years before being taken, and Thorn noted that some sweeps in the fourth wave were sitting unconfirmed in the mempool and had opted into replace-by-fee, meaning holders who act quickly and pay a higher fee may be able to outbid the attacker. About 600 suspected attacker addresses have been flagged to U.S. federal investigators, compliance firms and cross-industry cyber investigators, and 90% of the stolen $BTC has not yet moved, according to Galaxy.

The fallout has prompted a measurable shift in on-chain behavior. CryptoQuant head of research Julio Moreno said transfers of less than 1 $BTC totaled 39,600 $BTC (around $2.5 billion) on July 31, the highest since 39,900 $BTC on November 16, 2022, days after FTX failed. Sub-10 $BTC exchange deposits hit 7,300 $BTC ($459 million) that day, the most since February 6, and daily active addresses rose from 645,000 on July 30 to nearly a million on July 31, the highest since December 2024. Bitcoin's price barely moved amid the deposits, trading at $62,724 and down 0.7% over the past day per CoinGecko data, suggesting users were relocating coins rather than selling. Canadian coach Jonathan Goodman said on X that 18.25 $BTC, worth about $1.6 million Canadian, was swept from his Coldcard device, which had never been connected to the internet.

Bloomberg Intelligence senior ETF analyst Eric Balchunas wrote on X that "Yes, an ETF fixes this," arguing that U.S. spot Bitcoin ETFs remove seed-management risk for investors who want long-term price exposure without handling private keys. Balchunas also questioned whether a reportedly small hardware-wallet company should safeguard life-changing sums, calling the staffing level a "red flag," a figure Coinkite has not publicly confirmed. Kraken chief security officer Nick Percoco called the incident a "wake-up call for the entire hardware wallet ind[ustry]," and the episode has driven some affected users to move $BTC back to centralized exchanges such as Coinbase or Binance, inverting the industry's usual "not your keys, not your coins" ethos.