Coldcard Flaw Leads to $70M Bitcoin Theft in 41 Minutes

Massive Coldcard Breach: How $70M in Bitcoin Was Stolen

In one of the most unusual attacks in crypto history, attackers drained roughly 1,082 BTC—about $70 million—by compromising seeds created on Coldcard hardware wallets. The theft occurred in a narrow 41-minute window and, according to Galaxy Research, was executed without any physical or network access to the affected devices. Instead, the exploit targeted the private key generation process itself.

Attack vector: weak seed generation, not remote hacking

Unlike typical incidents that rely on exchange hacks, malware or phishing, this breach exploited a vulnerability in certain Coldcard firmware versions. Researchers found that some firmware releases did not use a true hardware random number generator (RNG) to create recovery seeds. Instead, they relied on a deterministic method using device serial numbers and timestamp data, which drastically shrank the possible keyspace.

That reduced entropy allowed attackers to generate millions of candidate private keys offline and match them against public blockchain addresses. By comparing generated public addresses to on-chain balances, attackers could identify valid wallets and transfer funds—without ever connecting to or touching the Coldcard devices.

Where the funds are now and ongoing risk

Blockchain analysis shows the stolen funds are concentrated in four Bitcoin addresses and have not been moved since the theft. Security teams warn of potential follow-up waves because users cannot easily verify whether their wallet seeds were produced by a vulnerable firmware version.

Coinkite response and recommended recovery steps

Coinkite, the maker of Coldcard, acknowledged the flaw, issued an apology, and released a patched firmware. Crucially, the company advised that simply updating firmware is insufficient for affected users. Anyone who generated a seed with a vulnerable firmware version must create a completely new seed phrase and transfer their assets to new cold storage to ensure safety.

Community guidance and broader implications

Binance founder Changpeng Zhao (CZ) urged users to diversify holdings across multiple wallets to reduce single-point-of-failure risk. This incident underscores that even hardware wallets and cold storage require rigorous attention to private key generation and firmware integrity. For the crypto community, the breach is a stark reminder: secure seed generation and regular firmware audits are as essential as offline custody.

The exploit highlights systemic risks in seed phrase generation, private key management, and firmware practices. Wallet manufacturers, auditors, and custodians must prioritize true entropy sources and transparent processes to protect users against offline brute-force attacks and blockchain tracing of exposed keys.