Coldcard Bug Shrinks Bitcoin Seed Security as Theft Estimate Tops $130M

Key Point

Coldcard wallets generated seeds from a software pseudo-random generator instead of the hardware random number generator. Galaxy Research has tracked more than 1,596 BTC stolen across three confirmed waves. A suspected fourth wave would lift the total to roughly 2,055 BTC, or about $130 million at current prices. Coinkite said older Mk2 and Mk3 devices running firmware 4.0.1 through 4.1.9 had about 40 bits of search space. Coinkite said fixed firmware is available for every affected model, but the update does not repair existing seeds.

Why it matters: Weak seed generation can turn self-custody into a direct key-recovery risk when attackers can search the reduced key space.

Market Sentiment

Bearish, Stress-on, Tech-driven, De-risking.

Reason: Galaxy Research tracked more than 1,596 BTC stolen across three confirmed waves, which raises custody-risk concerns.

Similar Past Cases

In September 2022, Ethereum vanity addresses generated with Profanity were drained after attackers could extract private keys. The Block reported $3.3 million stolen from several addresses. (The Block) The difference is that the Coldcard case involves Bitcoin hardware wallet seed generation, while Profanity involved Ethereum vanity address generation software.

Ripple Effect

Predictable seed generation could pressure self-custody confidence because users may question whether wallet builds call the intended entropy source. If affected seeds remain funded, then attackers could keep turning weak keys into on-chain thefts.

Opportunities & Risks

Opportunities: When fixed firmware is installed and a new seed is generated, then moving funds after a test transaction reduces exposure to compromised seeds.

Risks: If an affected seed was generated without dice rolls or a strong BIP-39 passphrase, then keeping funds on that seed is an exit signal from that wallet setup.