A Coldcard Firmware Bug From 2021 May Have Cost Bitcoin Holders $70 Million

Key points

• One attacker drained 1,196 Bitcoin addresses in 41 minutes on July 30, taking 1,082.65 BTC worth about $70.2 million.
• Galaxy Research links the theft to a firmware bug in Coldcard, a Bitcoin-only hardware wallet made by Canadian company Coinkite.
• A March 2021 firmware update accidentally routed wallet seed generation to a predictable software random number generator.
• Wallets set up on the buggy firmware version may still be exposed today, even if the device has since been updated.
• Anyone who generated a Coldcard seed in 2021 should move their funds to a freshly generated wallet.

One attacker emptied nearly 1,200 Bitcoin wallets in the time it takes to watch a sitcom.

On July 30, someone drained 1,196 addresses in 41 minutes, walking away with 1,082.65 BTC. That was worth roughly $70.2 million on the day. The sweep was so fast, and so precisely targeted, that it looked less like a hack and more like someone reading a list.

Researchers at Galaxy Research now think that is exactly what happened. In a writeup summarised by The Hacker News, they traced the theft to a firmware bug in Coldcard, a hardware wallet built by Canadian company Coinkite. A hardware wallet is a small physical device, roughly the size of a USB stick, that stores the secret keys to someone's cryptocurrency offline so hackers cannot reach them over the internet.

The problem is that the device only works if the secret it generates is actually secret.

How did the hackers get in?

They did not need to. A firmware update Coinkite shipped in March 2021 quietly broke the way Coldcard created new wallets, meaning the attacker could recalculate the keys instead of stealing them.

Here is the mistake in plain terms. When you set up a hardware wallet, it generates a long random number called a seed. Every Bitcoin address you ever use on that wallet is derived from that seed. If the seed is truly random, no one on Earth can guess it. If it is not, anyone who knows the pattern can regenerate it.

The 2021 firmware, according to Galaxy Research, accidentally wired seed generation to a deterministic pseudorandom number generator, a piece of software that produces numbers that look random but follow a fixed formula. Feed it the same starting point and it spits out the same sequence every time. That is fine for a video game. It is catastrophic for a wallet holding real money.

An attacker who worked out the formula could, in theory, generate the same seeds the affected devices did, derive every address from those seeds, and sweep the funds in one automated pass. The 41-minute drain fits that pattern.

Who is affected?

Anyone who set up a Coldcard wallet during the window the buggy firmware was live in 2021, and who has kept using the same seed since. Updating the firmware later does not fix a seed that was already generated weakly.

Coinkite has not, at time of writing, published a public advisory tying the July 30 sweep to the 2021 bug. Attribution here rests on Galaxy Research's on-chain analysis, so treat it as a strong single-source finding rather than settled fact.

What should Coldcard owners do?

If you generated a seed on a Coldcard in 2021, move your Bitcoin. Set up a new wallet on current firmware, generate a fresh seed, and send your funds to an address controlled by that new seed. Do not simply update the firmware on the old device and assume the money is safe. The seed is the thing at risk, not the device.

It is also worth checking any backup seed phrases written down in 2021. If they came from the affected firmware, they carry the same weakness.

Hardware wallets remain, on balance, safer than leaving coins on an exchange. But this incident is a reminder that a wallet is only as strong as the randomness behind it, and that a bug shipped years ago can sit quietly until someone works out how to cash it in.