Coldcard Exploit Drains $116M From Bitcoin Owners

Key Point

A Coldcard exploit drained funds from Bitcoin owners across four theft waves since Thursday. Galaxy Research said hackers moved approximately 1,816 BTC worth nearly $116 million off more than 5,200 affected addresses. Block's Bitcoin engineering and security teams said a 2021 Coldcard software update made recovery phrase generation pattern-based. Galaxy Research discovered that on July 30, 1,196 addresses were fully drained in 41 minutes for a little over 1,083 BTC. Coinkite advised users who generated wallet seeds on Coldcard devices to move their funds as soon as possible.

Why it matters: A seed-generation flaw may weaken trust in self-custody because attackers can bypass the physical device.

Market Sentiment

Cautiously Bearish, Stress-on, Event-driven, Fear.

Reason: The $116 million Coldcard exploit directly challenges confidence in a Bitcoin self-custody product.

Similar Past Cases

Atomic Wallet users lost more than $100 million in June 2023, and the incident later produced user litigation over the losses. (BloombergLaw) The difference is that Atomic Wallet was a software wallet case, while the Coldcard incident centers on hardware-wallet seed generation.

Ripple Effect

A wallet-generation flaw can spread from a product incident into a custody-behavior shift if holders lose confidence in self-custody tools. If users move funds rapidly after vendor warnings, then centralized venues may absorb more custody demand while wallet providers face stricter security scrutiny.

Opportunities & Risks

Opportunities: When Coinkite issues further migration or patch guidance, then delaying new self-custody deposits until the guidance is verified limits operational risk.

Risks: If additional theft waves continue, then reducing balances held on affected seed paths limits downside from repeated drains.