Coldcard Bitcoin Losses Rise to $70M After Wallet Vulnerability

Key Point

Galaxy Research stated on Friday that over 1,000 BTC from nearly 1,200 addresses have been moved, valued at approximately $70 million, with the transactions believed to be linked to a vulnerability affecting Coldcard hardware wallets. Coinkite warned on Thursday about an ongoing issue with seed phrases generated by Coldcard Mk3 devices. Coinkite said users who generated seed phrases using Mk3 devices with firmware version 4.0.1, released in March 2021, or later may have funds at risk. Coinkite later expanded the risk alert to certain firmware versions of Mk4, Mk5, and Coldcard Q, and released emergency firmware updates for all affected models. Coinkite CEO Rodolfo Novak, also known as NVK, apologized on Friday and said the company takes full responsibility for the firmware vulnerability.

Why it matters: Wallet firmware vulnerabilities could weaken self-custody confidence when affected seed generation creates direct loss risk.

Market Sentiment

Bearish, Stress-on, Event-driven, Fear.

Reason: The reported movement of over 1,000 BTC linked to a Coldcard vulnerability creates direct custody-risk pressure for Bitcoin holders.

Similar Past Cases

In June 2023, Atomic Wallet users lost more than $35 million in crypto after a large wallet compromise, and user confidence shifted toward security audits and fund-tracking efforts. (Fortune) Difference: Atomic Wallet involved a software wallet service, while the current case centers on hardware wallet firmware and seed phrase generation.

Ripple Effect

Weak seed phrase generation can turn self-custody into a correlated loss channel across users who relied on the same firmware. If more affected firmware versions or linked BTC movements appear, then wallet-risk repricing could spread from one product to broader hardware wallet trust.

Opportunities & Risks

Opportunities: If emergency firmware updates reduce new linked movements, then users can treat the incident as more contained and focus on confirmed affected-device guidance.

Risks: If Coinkite expands the affected scope again, then reducing exposure to affected wallets and moving funds to verified safe storage can limit operational risk.