A Coldcard Firmware Bug From 2021 May Have Cost Bitcoin Holders $70 Million

Key points

• One attacker drained 1,196 Bitcoin addresses in 41 minutes on July 30, taking 1,082.65 BTC worth about $70.2 million.
• Galaxy Research links the theft to a firmware bug in Coldcard, a Bitcoin-only hardware wallet made by Canadian company Coinkite.
• A March 2021 firmware update accidentally routed wallet seed generation to a predictable software random number generator.
• Wallets set up on the buggy firmware version may still be exposed today, even if the device has since been updated.
• Anyone who generated a Coldcard seed in 2021 should move their funds to a freshly generated wallet.

One attacker emptied nearly 1,200 Bitcoin wallets in the time it takes to watch a sitcom.

On July 30, someone drained 1,196 addresses in 41 minutes, walking away with 1,082.65 BTC, worth roughly $70.2 million on the day. The sweep was so fast, and so precisely targeted, that it looked less like a hack and more like someone reading a list.

Researchers at Galaxy Research now think that's exactly what happened. In a writeup summarised by The Hacker News, they traced the theft to a firmware bug in Coldcard, a hardware wallet built by Canadian company Coinkite. A hardware wallet is a small physical device that stores the secret keys to someone's cryptocurrency offline so hackers can't reach them over the internet.

The problem is that the device only works if the secret it generates is actually secret.

How did the hackers get in?

They didn't need to. A firmware update Coinkite shipped in March 2021 quietly broke the way Coldcard created new wallets, meaning the attacker could recalculate the keys instead of stealing them.

When you set up a hardware wallet, it generates a long random number called a seed. Every Bitcoin address you ever use on that wallet is derived from that seed. Truly random means unguessable. The 2021 firmware, according to Galaxy Research, accidentally wired seed generation to a deterministic pseudorandom number generator, a piece of software that produces numbers that look random but follow a fixed formula. Feed it the same starting point and it spits out the same sequence every time. That's fine for a video game. It's catastrophic for a wallet holding real money.

An attacker who worked out the formula could generate the same seeds the affected devices did, derive every address, and sweep the funds in one automated pass. The 41-minute drain fits that pattern precisely.

Who is affected?

Anyone who set up a Coldcard wallet during the window the buggy firmware was live in 2021, and who's kept using the same seed since. Updating the firmware later doesn't fix a seed that was already generated weakly. Any backup seed phrases written down during that window carry the same problem.

Coinkite hadn't, at time of writing, published a public advisory tying the July 30 sweep to the 2021 bug. Attribution rests on Galaxy Research's on-chain analysis, so treat this as a strong single-source finding rather than settled fact. Hardware wallet security has been under sustained pressure this summer: Ledger's Donjon team cracked a Tangem wallet card with a laser in July, and a week later a fake Sparrow Wallet app on the App Store drained $1.8 million in Bitcoin.

What should Coldcard owners do?

If you generated a seed on a Coldcard in 2021, move your Bitcoin now. Set up a new wallet on current firmware, generate a fresh seed, and send your funds to an address controlled by that new seed. Don't simply update the firmware on the old device and assume the money is safe. The seed is the thing at risk, not the device.

Hardware wallets remain, on balance, safer than leaving coins on an exchange. But this incident is a reminder that a wallet is only as strong as the randomness behind it, and that a bug shipped four years ago can sit quietly until someone works out how to cash it in. What strikes me most is the scale of patience implied: whoever did this apparently held the formula and waited.