Coldcard losses reach $114M in fourth sweep while Bitcoin holds firm

The Coldcard security incident has accelerated into a prolonged attack, with blockchain analysts tracking a fourth wave of fund transfers on Monday. Observed losses now stand close to $114 million as the running total climbs across multiple drains.

The initial wave, tracked by Coinkite and Chainalysis, captured roughly 594 BTC in a 25-minute window on 31 July. Galaxy Research later identified a separate, larger sweep involving 1,196 addresses and approximately 1,082.65 BTC. A third wave emerged over the weekend, bringing the three-wave total to roughly 1,367 BTC.

The underlying flaw was not phishing, malware, or physical compromise but rather a failure in how the wallet firmware generated recovery seeds. Two random number functions existed in the codebase with identical signatures—one from the hardware generator and one from a software fallback. A preprocessor guard checked only whether a build setting existed, not its value, so builds inadvertently used the weaker software version. The result was seeds that appeared valid and passed standard randomness tests, masking the vulnerability for over five years since a commit dated March 2021.

Despite the severity of the breach, Bitcoin has not collapsed as many traders anticipated. The asset reclaimed $63,000 in Asian trading on Tuesday and touched above $64,100 overnight, up roughly 2 percent on the day. The divergence between the scale of the security failure and the stability in price action has become the central question for markets.