Coldcard Bitcoin Theft Tops $114M as Wallet Drains Continue

Key Point

Hackers continue to drain Coldcard Bitcoin wallets, with total stolen funds now estimated at over $114 million. Galaxy Research's Alex Thorn said a fourth attack wave likely started on Sunday evening, with 388.9 Bitcoins worth over $29 million moved in new transactions. Coinkite said a firmware bug in Coldcard Mk3 devices starting with version 4.0.1 in March 2021 made seed generation fall back to a weak software pseudorandom number generator. Coinkite later admitted all models were vulnerable, destroyed remaining Coldcard inventory manufactured with the vulnerable firmware, and halted shipments. Block engineers reported that the hackers used a top blockchain services provider to help move funds, and Block engineers contacted the provider and federal authorities with their findings.

Why it matters: A wallet seed-generation flaw could weaken self-custody confidence and may push users to reassess device security.

Market Sentiment

Bearish, Stress-on, Tech-driven, Fear.

Reason: Hackers continue to drain Coldcard Bitcoin wallets with estimated losses above $114 million, which supports a stress-focused security read.

Similar Past Cases

In August 2022, the Solana Foundation said attackers drained 9,231 wallets of about $4.1 million after private keys were leaked or compromised, and users tied to Slope were told to move funds to new wallets. (Solana Foundation) The key difference is that the Coldcard case involves hardware-wallet seed generation, so the confidence impact may center more on cold-storage device trust.

Ripple Effect

The direct channel is custody confidence, because a seed-generation flaw can make users question whether stored Bitcoin remains secure. If more Coldcard-related addresses drain after user warnings, then self-custody risk may spread from affected devices to broader hardware-wallet behavior. If fund movement through service providers slows, then containment risk may improve.

Opportunities & Risks

Opportunities: If Coinkite publishes a clear remediation path or fund movement slows, then waiting for confirmed stabilization can reduce panic-driven custody decisions.

Risks: If additional Coldcard-related addresses drain or service-provider intervention fails, then reducing exposure to vulnerable custody paths is a defensive signal.