The cryptocurrency industry often emphasizes one golden rule: "Not your keys, not your coins." Hardware wallets have therefore become one of the most trusted tools for long-term Bitcoin stora
The cryptocurrency industry often emphasizes one golden rule: "Not your keys, not your coins."
Hardware wallets have therefore become one of the most trusted tools for long-term Bitcoin storage, allowing users to hold their private keys offline instead of relying on centralized exchanges.
However, recent reports surrounding certain Coldcard devices demonstrate that even hardware wallets are not immune to security flaws.
According to the information currently available, attackers continue exploiting a weakness tied to wallet seeds generated on vulnerable Coldcard firmware, resulting in an estimated 1,816 BTC—worth roughly $116 million—being stolen from more than 5,200 Bitcoin addresses.
The reported issue originates from a firmware bug introduced in March 2021 that weakened the randomness used during seed generation on certain Coldcard devices.
While later firmware updates addressed the flaw for newly generated wallets, the critical issue is that existing seeds created during the affected period remain vulnerable.
In other words, updating the device alone does not automatically secure wallets generated with compromised entropy.
Rather than a single isolated incident, the thefts have reportedly occurred in several coordinated waves.
Recent reports indicate:
These figures suggest that the campaign has continued over several days, with attackers repeatedly identifying and draining vulnerable wallets.
One particularly unusual aspect of the incident is that it reportedly involves multiple independent attackers, rather than a single coordinated hacking group.
Research cited in public reporting suggests that numerous parties are attempting to sweep vulnerable wallets before competing attackers do.
This creates a race in which exposed wallets may be targeted almost immediately after being identified.
Many users naturally assume that installing the latest firmware resolves the problem.
Unfortunately, the reported vulnerability affects the original seed generation process, not simply the device software currently installed.
A patched device prevents future vulnerable seed creation, but it cannot retroactively strengthen an already-generated seed.
For users whose wallets were created during the affected period, the recommended mitigation is:
Not every Coldcard user is necessarily affected.
According to the available reports, users who generated wallet entropy using 50 or more manual dice rolls or protected their wallets with a sufficiently strong BIP-39 passphrase are generally considered resistant to this specific attack.
However, users who relied solely on the vulnerable firmware-generated entropy during the affected period may remain exposed until their funds are migrated.
Incidents like this serve as an important reminder that self-custody is about far more than purchasing a hardware wallet.
Users should also:
Hardware wallets remain one of the strongest security tools available for cryptocurrency storage, but no system is immune to implementation mistakes.
The reported Coldcard exploit illustrates an uncomfortable reality within cybersecurity: vulnerabilities can remain dormant for years before attackers begin exploiting them at scale.
For users potentially affected by the vulnerable seed-generation period, acting quickly may be the difference between retaining full control of their Bitcoin and becoming another victim.
The broader lesson extends beyond one manufacturer.
In crypto, true security depends not only on the device you choose—but also on understanding how your keys were created, protected, and maintained over time.
