Coldcard Wallet Breach Exposes $112M Bitcoin Theft Risk

A hidden flaw in one of the most trusted names in Bitcoin self-custody has triggered the largest hardware wallet breach ever recorded. The Coldcard wallet breach traces back to a firmware bug that sat undetected since March 2021, quietly weakening the device’s ability to generate truly random seed phrases until attackers found it years later and drained more than 1,778 Bitcoin from thousands of victims.

Key takeaways

• A firmware bug active since March 2021 let attackers steal more than 1,778 Bitcoin, worth roughly $112.7 million, from over 8,600 Coldcard wallet addresses.
• The flaw originated in firmware version 4.0.1, which mistakenly rerouted seed phrase generation to a predictable software-based random number generator instead of hardware randomness.
• Galaxy Research believes attackers used AI models without cybersecurity restrictions to find and exploit the bug, while US AI safety policies limited defenders from using comparable tools.
• Coinkite issued a security advisory on July 30 and shipped patched firmware by July 31, but no multisignature Coldcard wallets were affected.
• Users on vulnerable firmware must generate entirely new seed phrases and migrate funds, since old keys remain permanently compromised.