Coldcard Hacker Wallet Gets Messages After $100M BTC Theft

Key Point

On-chain thefts tied to Coldcard devices now top $100 million, and a wallet holding about $36 million in stolen BTC has received 23 deposits with on-chain messages. Coinkite, the Toronto company behind Coldcard, disclosed last week that a catastrophic firmware bug generated seed phrases with roughly 40 bits of entropy instead of the intended 128 for over five years. Hackers used computational brute-force to crack customers' private keys and sweep their BTC. Galaxy Research said 1,596 BTC was stolen from about 7,300 addresses. Depositors sent 81,527 satoshis worth about $52 after mining fees, and 14 deposits carried written messages.

Why it matters: A compromised wallet-generation process could force users to reassess custody risk and may reduce trust in affected storage devices.

Market Sentiment

Bearish, Stress-on, Event-driven, Fear.

Reason: The theft of more than $100 million in BTC through weak Coldcard seed generation points to direct custody risk.

Similar Past Cases

In 2022, the Ronin Bridge hack stole roughly $620 million of Ethereum and USDC, and Sky Mavis raised $150 million to reimburse affected users. (Axios) The difference is that the Coldcard case centers on wallet seed generation rather than bridge validator compromise.

Ripple Effect

Seed-generation failure can spread through custody confidence because users may question whether private keys from affected devices are safe. If wallet users move funds away from affected devices, then custody stress could remain contained to compromised workflows rather than broader BTC market liquidity.

Opportunities & Risks

Opportunities: If Coinkite publishes a verified fix or recovery path, then reducing use of affected devices until that update is reviewed limits custody risk.

Risks: If stolen BTC keeps moving or more affected addresses are identified, then reducing exposure to compromised custody workflows is a defensive signal.