Coldcard Hacker's Wallet Becomes Bitcoin Blockchain Message Board

A major cyberattack targeting hardware wallets, long considered one of the most secure methods for storing cryptocurrencies, has left Coldcard users in distress. The security breach, which came to light in late July, reportedly resulted in the theft of over $100 million worth of Bitcoin (BTC) [1, 9, 17]. While the hacker’s wallet currently holds approximately $36 million in Bitcoin [1, 2, 3], victims and even some opportunists are continuously sending messages to this address using Bitcoin’s ‘OP_RETURN’ feature on the blockchain [1, 2, 6].

The incident began on July 30, following a disclosure by Coldcard hardware wallet manufacturer Coinkite Inc. The company revealed a software flaw, present in certain Coldcard Mk2 and Mk3 models since March 2021, that caused the wallets to generate weak random numbers during the ‘seed phrase’ creation process [9, 14, 20]. Instead of employing robust randomness, which is fundamental to cryptographic security, a fallback mechanism based on predictable values like the device's serial number was utilized, allowing attackers to reconstruct private keys and access wallets [16, 21]. According to analyses by Galaxy Research, the attacks occurred in three main waves, with Bitcoin being stolen from over 7,300 addresses in total [17].

Although the direct impact on broader markets has been limited, the attack has eroded trust in ‘cold storage’—a method widely regarded as one of the safest for Bitcoin. Some victims lost their life savings [4, 8], raising serious questions about the fundamental security principles of cryptocurrencies. Bitcoin’s price continued to trade around $64,300 during the events [9], but such large-scale security breaches underscore the need for investors to be more cautious regarding hardware wallet selection and self-custody practices [9, 14].

This hack highlights the complexity of security vulnerabilities within the crypto ecosystem and demonstrates how even seemingly advanced technologies can be compromised due to human error or software flaws. Coinkite, Coldcard’s manufacturer, acknowledged the issue, released patched firmware updates for all affected Coldcard models, and urged users to immediately migrate their funds to new, secure addresses [8, 15, 21]. However, the company has not offered any compensation to the victims [8, 9].

Analysts and market experts warn that such incidents could negatively impact the long-term adoption of cryptocurrencies. It is particularly emphasized that the advantage of hardware wallets being “offline” may prove insufficient against fundamental weaknesses like flawed seed phrase generation [20]. In the upcoming period, hardware wallet manufacturers are expected to further tighten their security protocols and increase independent audits. Cryptocurrency investors are advised not only to use hardware wallets but also to thoroughly understand the wallets’ seed phrase generation processes and updates.