Coldcard Firmware Flaw Lets Attackers Drain Over $70M in Bitcoin

Key Point

Hardware wallet users lost more than $70 million in Bitcoin (BTC) after attackers exploited a Coldcard firmware flaw that allowed remote draining of funds. CoinKite said some affected devices generated recovery seeds with software-based randomness instead of the built-in hardware random-number generator. The issue originated in firmware released in March 2021, and newer firmware resolves the bug but does not secure recovery seeds generated on affected devices. Galaxy Research tracked 1,082.65 BTC swept from 1,196 addresses in roughly 41 minutes. Changpeng Zhao said hardware wallets can have bugs and suggested splitting funds across wallets while noting that this approach has different risks.

Why it matters: A seed-generation flaw may weaken confidence in self-custody when users cannot fix old recovery seeds through a firmware update alone.

Market Sentiment

Bearish, Stress-on, Event-driven, Fear.

Reason: More than $70 million in Bitcoin was drained through a Coldcard firmware flaw, which creates direct security stress for self-custody users.

Similar Past Cases

In the 2023 Atomic Wallet hack, users lost more than $35 million after many wallets were drained across multiple assets. (Fortune) The key difference is that the Coldcard incident centers on firmware-generated recovery seeds, while the Atomic Wallet case involved a software wallet compromise.

Ripple Effect

The first channel is self-custody confidence, because a seed-generation flaw can make offline storage look less isolated from software risk. If more wallet sweeps appear after emergency patches, then concern may shift from one firmware bug to broader recovery-seed replacement behavior. The second channel is custody behavior, because users may reassess whether single-device storage creates concentrated operational risk.

Opportunities & Risks

Opportunities: If Coinkite updates show that new drains are contained, then stabilization in self-custody confidence can be a potential entry signal for users monitoring wallet-infrastructure exposure.

Risks: If older recovery seeds remain in use or additional sweeps appear, then reducing reliance on a single wallet setup limits downside from another drain.