Coldcard firmware flaw enables systematic Bitcoin theft exceeding $114M

Coldcard, one of Bitcoin's most trusted hardware wallets, became the centre of one of the largest self-custody thefts after attackers exploited a firmware flaw to systematically drain coins from offline storage.

The vulnerability stemmed from a March 2021 firmware update that drew wallet seeds from weak software fallback rather than the hardware random generator, reducing key security from the intended 128 bits to approximately 40 bits. This made private keys guessable, enabling coins held for years in internet-disconnected wallets to be swept away. Galaxy Research traced roughly 1,367 Bitcoin stolen across 4,585 addresses in three waves, valuing the loss at approximately $88.6 million, with a potential fourth wave pushing estimated damages toward $114 million.

Coinkite, Coldcard's manufacturer, acknowledged that attackers likely used artificial intelligence to identify the flaw in the company's open-source firmware. The company admitted that its own AI review of the same code weeks earlier failed to detect the vulnerability. Researchers noted that the sweeps appeared programmatic, likely orchestrated using large language models, and warned that every vulnerable device faces eventual emptying. Galaxy Research has provided roughly 600 suspected attacker addresses to federal investigators.