Bitcoin holders are losing millions. A fourth round of attacks hit Coldcard users over the weekend, with hackers siphoning off another 388.9 bitcoins worth roughly $29 million. Galaxy Research analyst Alex Thorn flagged the suspicious transactions Sunday evening, marking an acceleration in what's become a weekend-long disaster for the hardware wallet maker.
The bleeding started Thursday when thieves first cracked open over $35 million in bitcoin from Coldcard devices. The vulnerability is almost laughably simple once you know it exists. Coldcard Mk3 wallets running firmware version 4.0.1 and later have a bug that forces seed generation to use weak software randomness instead of the device's dedicated hardware random number generator. That means hackers can brute-force the recovery phrases that unlock these wallets. Coinkite, the company behind Coldcard, acknowledged the flaw but the damage is already staggering.
What makes this worse is scope. One drained address lost 51 bitcoins. That's not a typo. Someone who spent years accumulating five dozen bitcoins in what should be the most secure setup available just watched it vanish.
All Models at Risk
Coinkite initially thought the problem was confined to Mk3 devices. They were wrong. The company revealed Monday that every Coldcard model is potentially vulnerable. Engineers now warn that basically any bitcoin address ever generated on a Coldcard could eventually be compromised as hackers work through the math.
The company posted a statement that's part mea culpa, part shock. "Money that took years to save, gone. Trust that took years to build, broken." They're destroying remaining inventory and halting shipments, but that's cold comfort to people who already lost everything.
The total damage has crossed $114 million. Coinkite is asking what went wrong internally. For their customers, the question is whether anything Coinkite makes can be trusted again.
This is informational content about recent cryptocurrency security events. Not financial advice. If you own a Coldcard device, move your funds immediately.
