Attacker Drains $116M in Bitcoin From Coldcard-Generated Wallets

An attacker has moved roughly 1,816 bitcoin—about $116 million—from more than 5,200 addresses tied to seeds generated on Coldcard devices since July 30. Galaxy Research said the largest sweep totaled 1,082 bitcoin taken from 1,196 wallets in a 41-minute window. The incident is linked to an entropy issue in Coldcard firmware version 4.0.0, shipped in March 2021. That release included a build setting that instructed the device to bypass its dedicated hardware randomness chip, raising the risk that seed generation could be weakened. Coinkite CEO Rodolfo Novak urged users who created seeds with Coldcard wallets to migrate funds and rotate to new setups using updated best practices. Users who generated seeds with at least 50 private dice rolls, or who used a strong passphrase, are believed to be unaffected. Why it matters: Failures in wallet entropy can turn offline self-custody into silent key exposure, challenging assumptions about hardware wallet security. Market sentiment: Cautiously bearish—stress-on, tech-driven de-risking. The reported drain from Coldcard-generated addresses may undermine confidence in self-custody hardware security. Similar past case: Trust Wallet previously fixed a WebAssembly vulnerability in its browser extension after the flaw led to about $170,000 in user losses, according to The Block. That episode highlighted how weak seed generation can leave wallets exposed even without phishing or device theft. The key distinction is that Trust Wallet involved browser-extension software, while this event centers on seed generation tied to a Coldcard hardware wallet. (The Block) Ripple effects: Renewed doubts about entropy could push users away from single-device custody and toward setups with stronger operational controls. Demand for third-party custody may rise if large holders conclude that hardware isolation alone does not address implementation risk. If Coinkite publishes a technical review and migration guidance, containment will likely depend on how quickly users rotate potentially vulnerable seeds. Opportunities and risks: Opportunities: A detailed technical review could establish a clear fault boundary and help repair confidence among hardware wallet users. If migration guidance is narrow in scope, self-custody providers with stronger entropy controls may benefit from increased trust. Risks: If additional waves drain more Coldcard-generated addresses, reducing single-device exposure could limit operational downside. If the technical review indicates broader seed-generation exposure, custody and security risks could remain elevated for affected users.