Coldcard hack drains $70 million, raises Bitcoin storage risk

Coldcard wallets lost about $70 million in Bitcoin in a 40‑minute attack on July 30, highlighting a firmware bug that made seed generation predictable and forcing owners to create new seeds to protect their holdings【1】.

How the breach unfolded

A 2021 firmware change stopped Coldcard’s hardware RNG and fell back to a software generator built from the chip’s serial number and internal clock readings. This limited each device to roughly four billion possible seeds—a space a modern computer can enumerate quickly. Attackers generated candidate seeds, derived the corresponding addresses, and matched them against the public blockchain, draining the highest‑value wallets first. Chainalysis reported $30 million was taken in the first ten minutes, and the sweep continued for about 40 minutes before Coinkite issued its first warning【1】.

Market reaction and broader impact

Bitcoin’s price slipped below its $60,000 support level after news of the hack, with fears it could breach the $58,000 level seen at the end of June【2】. The incident also sparked concerns that similar vulnerabilities could affect other hardware wallets that import seeds, as the compromised seed remains guessable even after migration to a different device【2】.

Mitigation steps and remaining exposure

Coinkite released firmware that restores proper hardware randomness, but the fix cannot retroactively secure seeds already generated by the flawed firmware. Owners must generate a completely new seed on the updated firmware and migrate funds to the new address. Those who mixed additional entropy—by rolling physical dice during setup—produced seeds outside the attacker’s searchable pool and escaped loss【1】. A strong passphrase adds a layer of protection, though a weak one offers limited defense. Multisig configurations that include keys from unaffected devices also reduce exposure, but a multisig composed solely of vulnerable Coldcards remains at risk【1】.

What to watch

• Price levels: Bitcoin holding above $60,000 vs. potential drop below $58,000 as market sentiment reacts to the hack.
• Firmware updates: Adoption rate of the fixed Coldcard firmware (version 4.0.2 or later) across affected devices.
• Seed migrations: Volume of on‑chain transactions moving funds from addresses linked to the vulnerable seed pool to newly generated wallets.

The Coldcard breach underscores that offline storage protects keys from direct theft but cannot guarantee seed entropy. As long as firmware‑level randomness flaws exist, even “cold” wallets remain vulnerable, prompting a reassessment of hardware‑wallet security practices.