Coldcard Hack Drains 1,596 BTC as Galaxy Flags Possible 4th Wave

Key Point

Galaxy Research confirmed hackers stole 1,596 BTC, worth more than $100 million, from approximately 7,300 Coldcard hardware wallet addresses across three coordinated attack waves and 14 smaller incidents. Galaxy also flagged a suspected fourth wave that would push the total to 2,055 BTC, or roughly $130 million, if victim reports confirm it. The flaw traces to a March 1, 2021 code change in Coinkite's Coldcard firmware that made seed generation fall back to a software-based pseudorandom number generator. Block's engineering team estimated the effective search space collapsed to roughly 40 bits for Mk3 devices under some conditions. Coinkite released emergency firmware updates, but firmware updates do not secure already-generated seeds.

Why it matters: Weak seed generation may turn a hardware wallet issue into a direct custody risk because attackers can search vulnerable seeds offline.

Market Sentiment

Bearish, Stress-on, Tech-driven, Fear.

Reason: Hackers stole 1,596 BTC from approximately 7,300 Coldcard hardware wallet addresses, which may weaken confidence in hardware wallet security.

Similar Past Cases

In the 2022 Ronin Bridge hack, attackers stole roughly $620 million worth of Ethereum and USDC, and Sky Mavis raised $150 million to reimburse affected users. (Axios) The key difference is that Ronin involved a network bridge, while the Coldcard case centers on seed generation in hardware wallet firmware.

Ripple Effect

Weak seed generation can spread risk through public blockchain scanning because attackers can test candidate seeds without physical access to devices. If additional victim reports confirm the suspected fourth wave, then exchanges and investigators may treat the incident as a wider containment problem. If patched-seed migration is slow, then more vulnerable addresses may remain exposed.

Opportunities & Risks

Opportunities: When users move BTC from already-generated seeds to patched or unaffected hardware, then affected holders can reduce custody risk before further sweeps appear.

Risks: If victim reports confirm the suspected fourth wave, then reducing exposure to addresses generated under affected firmware limits downside from repeat drains.