Coldcard Bitcoin Theft Tops 1,367 BTC After Wallet Firmware Bug

Key Point

Hackers used a Coldcard firmware RNG integration bug to drain BTC from affected wallets. Galaxy Research counted 1,082.65 BTC drained from 1,196 addresses in the initial wave and later estimated losses exceeded 1,367 BTC from 4,585 addresses. The flaw appeared in firmware 4.0.1 on March 29, 2021 and persisted through July 30, 2026. Coinkite first said Mk4, Q and Mk5 devices were not affected based on early analysis, but Coinkite later widened the scope to Mk4, Mk5 and Q devices. Coinkite released firmware 4.2.0 and said the update fixes new private key generations but cannot repair a past, compromised seed phrase.

Why it matters: A wallet entropy failure can turn self-custody into direct key exposure, so unresolved vulnerable seed phrases may keep funds at risk.

Market Sentiment

Bearish, Stress-on, Tech-driven, De-risking.

Reason: Hackers drained more than 1,367 BTC through a Coldcard firmware bug, which creates direct custody risk for affected wallet users.

Similar Past Cases

In September 2022, Wintermute lost $160 million after a Profanity-type private-key compromise affected its DeFi operations, and the firm said it would continue on-chain trading. (The Block) Difference: The Wintermute case centered on one market maker, while the Coldcard incident affects many wallet users through seed phrase generation.

Ripple Effect

Private-key exposure can spread from discovered vulnerable seed phrases to additional theft waves if attackers continue brute-force scanning. If new theft transactions continue after firmware updates, then the incident remains an active custody-risk event rather than a completed exploit.

Opportunities & Risks

Opportunities: If a Coldcard user generated a seed phrase on affected firmware, then moving funds to a newly generated secure wallet can reduce direct private-key exposure.

Risks: If additional drain transactions continue after firmware 4.2.0, then reducing exposure to wallets created with compromised seed phrases limits further theft risk.