The amount of Bitcoin stolen through the Coldcard hardware wallet security incident has climbed to more than 1,367 BTC, worth approximately $88.6 million, according to the latest blockchain analysis, making it one of the largest hardware wallet compromises in Bitcoin’s history. Researchers tracking the exploit say the attacker has now drained funds from 4,585 Bitcoin addresses, a dramatic increase from the roughly 500 wallets initially believed to have been affected when the incident first came to light.
The compromise has expanded rapidly over the past several days as investigators continue identifying vulnerable wallets generated using affected versions of Coldcard firmware. Initial estimates placed losses at around 594 BTC, before rising to more than 1,100 BTC and now exceeding 1,367 BTC as additional victims were discovered. Coldcard manufacturer Coinkite has acknowledged a flaw affecting historical seed generation on certain firmware versions and urged potentially affected users to immediately migrate funds to newly generated wallets. The company stressed that the vulnerability relates to how wallets originally generated their recovery seed, rather than a failure of offline key storage itself.
Predictable Seed Generation Enabled the Theft
According to investigations by Block’s Bitcoin engineering and security teams, the exploit stems from insufficient entropy during wallet creation on certain Coldcard devices. Rather than relying exclusively on a cryptographically secure random-number generator, affected firmware versions could generate seed phrases using predictable hardware values, including chip serial numbers and internal clock registers under specific conditions. That significantly reduced the number of possible seed combinations, allowing attackers with sufficient computing resources to reconstruct private keys through brute-force analysis.
Once valid seed phrases were recovered, attackers could recreate victims’ wallets without ever accessing the physical hardware device. Blockchain data indicate many affected wallets had remained dormant for years before being emptied within minutes as the attacker systematically swept funds into consolidation addresses.
The exploit primarily affects wallets created on vulnerable firmware versions. Users who generated seeds using external entropy, dice rolls, passphrases or unaffected firmware versions face substantially lower risk, although Coinkite has recommended that all users review their wallet generation history and migrate to fresh seeds where appropriate.
One of Bitcoin’s Largest Hardware Wallet Incidents
The growing scale of the exploit has shocked the Bitcoin community because hardware wallets are widely regarded as the most secure method of self-custody. Unlike previous high-profile cryptocurrency thefts involving centralized exchanges, this incident targets private wallets whose owners maintained direct control of their assets. That distinction has intensified concern across the industry, even though the vulnerability appears confined to specific Coldcard firmware versions rather than Bitcoin itself.
Researchers note that the attacker has not indiscriminately targeted every Coldcard wallet. Instead, blockchain analysis suggests victims share characteristics consistent with wallets created using the vulnerable seed-generation process. The latest estimate of 1,367 BTC stolen across 4,585 addresses remains provisional and may continue to rise as additional vulnerable wallets are identified or previously unnoticed thefts are linked to the same exploit.
For affected users, the priority remains clear: determine whether their wallet was generated using an impacted firmware version and, if there is any uncertainty, immediately transfer funds to a newly created wallet generated with verified randomness. As investigations continue, the incident serves as a stark reminder that even offline hardware security ultimately depends on the integrity of the software used to generate cryptographic keys.
