Coldcard Overhauls Seed Security After $130M Bitcoin Exploit

Key Point

Coinkite released new Coldcard firmware after a seed-generation flaw led to roughly $130 million in stolen Bitcoin. Coldcard now requires at least 65 key presses, 50 dice rolls, or 128 coin flips when users generate a new wallet seed. Coinkite said users who created seeds on affected versions between 2021 and July 2026 must create new seeds with updated firmware and move their Bitcoin. The firmware also adds transaction checks before signing and warnings for changed transactions. Coinkite described the transaction-signing issue as theoretical and did not say it had been exploited.

Why it matters: Stronger seed generation may reduce the risk that attackers can guess wallet keys and drain affected Bitcoin wallets.

Market Sentiment

Neutral, Stress-on, Tech-driven.

Reason: The seed-generation flaw resulted in roughly $130 million in stolen Bitcoin, which places wallet security risk at the center of the event.

Similar Past Cases

In March 2022, compromised validator keys enabled attackers to drain roughly $625 million from the Ronin bridge. Sky Mavis later raised $150 million to reimburse affected users and replace compromised validators. The difference is that the Ronin breach affected pooled bridge funds, while the Coldcard incident involved weak seed generation on individual hardware wallets. (The Block) (theblock.co)

Ripple Effect

The required migration to new seeds could create short-term security and support demands among affected Coldcard users. If users complete the migration and thefts stop, the impact could remain concentrated among affected Coldcard wallets.

Opportunities & Risks

Opportunities: When updated Coldcard firmware is installed, users can create a new seed with added user randomness before moving Bitcoin.

Risks: If a wallet used affected versions between 2021 and July 2026, users can move Bitcoin after creating a new seed to limit exposure to the known flaw.