Coldcard Releases Firmware After $114M Bitcoin Theft, Warns Patch Isn't a Cure

The difference between a patched wallet and a safe wallet is not always obvious. Coldcard has shipped new firmware after a $114 million bitcoin theft tied to a flaw in its hardware wallet, and the company is drawing that line explicitly. According to the original report, the update follows three weeks of review that uncovered additional bugs unrelated to the original exploit. But installing the firmware does not make an already compromised wallet safe.

The warning is not boilerplate. A firmware update can close a software path, but it cannot recover a seed phrase or private key that has already been exposed. If an attacker was able to extract key material through malicious firmware or another vulnerability, the exposed credentials remain dangerous no matter how many patches arrive later. That distinction shapes whether users should update in place or abandon the device and move funds to a new seed.

The review exposed more than one weak point

Coldcard’s three-week review apparently did more than focus on the single flaw behind the $114 million loss. The company says the process turned up unrelated problems, which suggests the audit looked across the broader firmware codebase rather than just shipping a narrow fix. The use of AI to help catch more bugs is notable because hardware wallet code has very little tolerance for error. A missed edge case can mean loss of principal, not just a bad user experience.