Coldcard Firmware Flaw Leads to $70 Million Bitcoin Theft

A critical firmware vulnerability in Coldcard hardware wallets has resulted in the theft of millions of dollars in Bitcoin, undermining one of the industry's most trusted cold-storage solutions. The flaw allowed attackers to predict private keys and systematically drain funds from affected devices.

According to blockchain analysis by Galaxy Research, the exploit led to a massive sweep of 1,196 addresses, totaling approximately $70.2 million (1,082.65 BTC). The scale and speed of the attack were unprecedented, with the $70.2 million sweep occurring within a narrow 41-minute window. While some reports, including one from Fortune, have cited total losses as high as $116 million, the Galaxy analysis provides the most detailed technical accounting of the specific sweep.

The Technical Failure

The vulnerability stemmed from a fundamental error in how the devices generated wallet seeds. Instead of utilizing the STM32 hardware random number generator (RNG), the firmware relied on a deterministic software pseudo-random number generator (PRNG). This failure weakened the entropy of the seeds, making the resulting private keys predictable for attackers who understood the flaw.

Coldcard, produced by the Canadian firm Coinkite, has long been regarded as a gold standard for Bitcoin security. Its air-gapped design—which ensures the device never connects directly to the internet—is intended to eliminate the primary attack vectors associated with digital wallets. However, this incident proves that hardware-level isolation cannot protect users if the underlying software generating the keys is fundamentally flawed.

Implications for Self-Custody

This exploit reignites a fierce debate within the cryptocurrency community regarding the safety of self-custody versus institutional custody, such as Bitcoin ETFs. For years, the mantra "not your keys, not your coins" has driven users toward hardware wallets to avoid the risks associated with centralized exchanges. This event demonstrates that even the most rigorous security designs can suffer from catastrophic software failures.

Industry analysts suggest that such a systemic failure may push cautious investors away from managing their own keys and toward regulated financial intermediaries. The psychological impact is significant; when a device specifically marketed for maximum security fails at its most basic function—seed generation—the perceived risk of self-management increases.

What Remains

While the technical cause of the exploit has been identified, the full scope of the affected user base remains a point of scrutiny. Users are being urged to migrate funds to new wallets generated with secure firmware. The industry now watches to see if other hardware manufacturers utilize similar PRNG implementations, which could signal a wider systemic risk across the cold-storage ecosystem.