Coldcard hardware wallets lose $30 million in rapid attack

A attacker siphoned roughly $30 million from Coldcard hardware wallets in the first 10 minutes of a 25‑minute sweep that hit 500 wallets, highlighting lingering seed‑generation flaws in the device’s firmware [2].

Attack mechanics and scale

Chainalysis reported that the perpetrator prioritized the largest Coldcard wallets, extracting $30 million within ten minutes before expanding to smaller balances. Three of the ten biggest victim wallets each held at least 10 BTC (≈ $636 k per wallet at the time) [2]. The operation continued for about 25 minutes, ultimately draining 500 distinct wallets and pushing the total value taken past $38 million. The pattern suggests the attacker pre‑mapped the wallet population to maximize early gains rather than proceeding randomly.

Vulnerabilities and response

The breach exploited seeds generated on vulnerable firmware, a risk that persists even after applying the hotfix released by Coldcard. Bitkey’s engineering lead, Clay Garrett, noted that the attacker used a paid account with a major blockchain‑services provider to query source addresses, enabling the precise targeting of high‑balance wallets [2]. Although the provider supplied standard services, the specificity of the requests helped investigators trace the operation, underscoring the importance of securing both hardware and the ancillary services used for address look‑ups.

What to watch

• Firmware updates – Monitor Coldcard’s release notes for any further patches addressing seed generation.
• Large‑balance wallet activity – Watch for unusual outbound flows from wallets holding ≥ 10 BTC, especially on the Bitcoin network’s mempool.
• Blockchain‑service provider logs – Any anomalies in query patterns from known service accounts could signal repeat targeting.

The incident demonstrates that even “offline” cold storage can be compromised through firmware weaknesses and external query services, raising questions about the long‑term resilience of hardware wallets without rigorous seed‑generation safeguards.