A March 2021 Coldcard firmware flaw let attackers steal about 1,367 BTC worth roughly $89 million from thousands of addresses. Researchers say vulnerable wallets remain at risk and urge immediate fund moves
A coding error in Coldcard firmware released in March 2021 has allowed attackers to drain roughly 1,367 bitcoin, valued near $89 million, from 4,585 addresses. According to Galaxy Research, the theft unfolded in three waves between July 30 and August 2, with the firm flagging the latest sweep early on August 2. The incident has pushed many long-term self-custody users to reassess how seed generation and hardware randomness actually protect funds.
The vulnerability sits in version 4.0.1 of the Coldcard Mk3 firmware. That build incorrectly sent seed-phrase generation through a software-based random number generator instead of the device's dedicated hardware chip. Software randomness can produce a predictable, bounded set of outputs. Anyone who understands the flaw can reconstruct candidate private keys offline and test them against funded addresses without ever touching a physical wallet.
Attack Pattern
Galaxy Research mapped three distinct waves. The first struck on July 30, moving 1,082.65 BTC from 1,196 addresses in a 41-minute window between 1:10 and 1:51 a.m. UTC, averaging close to 1 BTC per victim. The second wave focused on mid-sized balances. By the third wave, average losses fell to roughly 0.1 BTC per address, which Galaxy's head of research Alex Thorn linked to the attacker already clearing the highest-value keys from the vulnerable space.
Tactics also shifted. Earlier waves sent funds into a small set of shared collector addresses that were easy to cluster. Wave three sent each victim's coins to a unique destination, used pay-to-witness-script-hash outputs that can embed multisignature or timelock conditions, and batched about six victims per sweep transaction instead of processing one address at a time. It also stayed on the default key-derivation path rather than scanning multiple branches. Galaxy said it is confident each wave reflects a single internal operator but declined to formally tie the three waves together. Stolen coins from all waves have remained in attacker-controlled addresses and have not moved further.
Company Response
Coinkite CEO Rodolfo Novak, known online as NVK, apologized on July 31 and said the company accepts full accountability for the firmware bug and for an internal review process that failed to catch it. He suggested the issue may have surfaced through AI-assisted code analysis of publicly available firmware and described the episode as a sober reminder of how quickly dormant bugs can be found. Coinkite widened its advisory beyond the Mk3 to certain Mk4, Mk5, and Coldcard Q firmware versions and released emergency updates for affected models.
Galaxy Research reported sharing roughly 600 suspected attacker addresses with federal investigators, compliance firms, and industry cybersecurity researchers. On August 2, Thorn stated publicly that the attack was still ongoing and urged anyone holding single-signature funds on Coldcard-generated addresses to move them immediately. He noted the stolen coins had sat dormant for an average of 3.18 years before being swept, pointing to long-term holders as the primary victims.
User Impact
The exploit has reversed a common self-custody habit for many affected users. Large numbers are moving bitcoin off hardware wallets onto centralized exchanges or newly generated addresses. For some, the warning arrived too late. Canadian fitness coach Jonathan Goodman reported that 18.25 BTC, worth about CA$1.6 million ($1.16 million), was swept from his wallets in a seven-minute window on July 29. His private keys had been kept in a physical safety deposit box and had never been connected to the internet. He said he is filing reports with police and the Ontario Securities Commission.
Based on figures tracked by Galaxy Research across the three waves, attackers removed approximately 1,367 BTC from 4,585 addresses, with the first wave alone accounting for 1,082.65 BTC from 1,196 addresses and the third wave draining about 208 BTC from 1,912 addresses between midday July 31 and the morning of August 1 UTC. The coins have not been observed leaving attacker-controlled wallets as of the latest reporting.
Hardware wallets are designed to keep private keys offline and to generate entropy with dedicated secure elements so that seed phrases cannot be guessed from software patterns. When firmware routes randomness to a predictable software generator, the security model collapses even if the device never connects to the internet and the seed never leaves a vault. Users who generated seeds on affected firmware versions face a race against offline key enumeration, not a traditional remote hack. Moving funds to addresses derived from a correctly generated seed, verifying firmware authenticity before any new setup, and treating long-dormant single-signature UTXOs as high priority remain the practical steps available while investigators and the manufacturer continue their response.
