Coldcard Exploit Confirmed at $111M as Investigation Uncovers Dozens of Attack Patterns

The scope of the Coldcard vulnerability has grown substantially as investigators continue identifying victims. Confirmed stolen amounts now total at least 1,719 Bitcoin, or roughly $111 million, with unverified cases suggesting total losses could surpass $130 million and involve more than 2,300 Bitcoin.

The flaw affected certain Coldcard wallet models using firmware released after March 17, 2021. Rather than requiring physical compromise of the hardware wallet, the vulnerability allegedly exposed wallet seeds—the master cryptographic keys that control Bitcoin—allowing attackers who recreated them to access funds. Wallets created before the March 2021 firmware date showed no signs of theft.

Investigators identified over 25 distinct attack patterns across three separate waves, suggesting multiple threat actors exploited the flaw. More than 250 victims have reported losses, though the number of affected addresses could be substantially higher since individual victims may have used multiple wallets. Galaxy Research determined that Mk3, Mk4, Mk5, and Q model Coldcard devices appeared vulnerable if running the affected firmware versions.

One attack drained approximately 594 Bitcoin, worth $38 million, from 500 wallets within 15 to 25 minutes. Despite the scale of the incident, Bitcoin's core network remained unaffected and the broader cryptocurrency community continued operating normally.