Hackers drained $130 million in Bitcoin from 7,300 'cold' wallets once billed as secure

A tool meant to keep Bitcoin far from online thieves has become the latest reminder that "offline" does not always mean untouchable.

An ongoing exploit in Coldcard hardware wallets has cost users tens of millions of dollars, hitting devices that many in cryptocurrency had treated as one of the safest places to keep Bitcoin, Bloomberg reported.

What happened?

In late July, Canada-based Coinkite Inc. told users that some Coldcard devices had produced vulnerable seed phrases — the strings of words used to access a wallet.

By August 3, Galaxy Research said around 7,300 addresses had been compromised, with an estimated $130 million stolen. 

Engineers at Block Inc. traced the issue to the wallets' random-number generation. In affected firmware, seed phrases were not always fully unpredictable and could instead be derived from deterministic inputs such as device serial numbers, making them far easier for attackers to reconstruct.

For people who chose cold storage specifically to avoid internet exposure, the attack was shocking.

Jonathan Goodman, one of the victims, wrote on X, "My Bitcoin was in cold storage. My keys were on a ColdCard device kept in a safety deposit box that had never been connected to the internet."