Coldcard Hack Drains Over $100M in Bitcoin, Prompting Custody Shift

Key Point

Attackers began draining bitcoin from thousands of Coldcard hardware wallets last Thursday. Galaxy Research said almost 1,600 BTC valued at over $100 million was swept from around 7,300 addresses after three attack waves. A March 2021 firmware update for the Coinkite-made wallet left users with private keys that were less secure than they should have been. Swan CEO Cory Klippsten said Swan paused withdrawals for at-risk clients, sent in-app warnings, and helped affected holders outside its client base. Affected users are migrating toward vaults that prevent any single compromised device from putting funds at risk.

Why it matters: A hardware wallet compromise may push holders toward custody setups that reduce single-device failure risk.

Market Sentiment

Cautiously Bearish, Stress-on, Event-driven, De-risking.

Reason: The attack swept almost 1,600 BTC from Coldcard wallets, which may reduce confidence in single-device self-custody.

Similar Past Cases

In August 2022, the Slope wallet incident drained 9,231 wallets of about $4.1 million in assets over about four hours after private keys were leaked or compromised. (Solana) The difference is that the Coldcard case involved a hardware wallet firmware flaw and larger bitcoin losses, so the custody response may focus more on vault design.

Ripple Effect

A hardware wallet failure can spread through the confidence channel from one device maker to broader self-custody behavior. If more holders move coins into vaults, then demand may shift toward custody designs that require more than one signing device. If migration support remains orderly, then immediate pressure may stay focused on security operations rather than broad market selling.

Opportunities & Risks

Opportunities: If affected holders complete vault migrations, then stronger multi-device controls become a practical risk-reduction signal for self-custody users.

Risks: If more at-risk addresses are drained, then reducing dependence on vulnerable single-device setups limits custody downside.