A shocking storage exploit bankrupts Bitcoiners — with lessons for us all

Coldcard, one of the better-known hardware wallets in the Bitcoin world, shipped a firmware bug that weakened the secret keys protecting customers' money. By Saturday afternoon, Galaxy Research had identified three waves of suspected theft totaling 1,367.05 Bitcoin, worth about $88.6 million, across 4,585 addresses.

That is the observed damage, not necessarily the final bill. Galaxy's method spots a particular attacker's habits on the public Bitcoin ledger. The researchers warn that another thief could change a few details and blend into ordinary wallet traffic, making additional thefts much harder to count. An address is not the same thing as a person, either, so 4,585 addresses does not mean 4,585 victims. The actual number of people robbed remains unknown.

The danger had not passed by Saturday evening. Galaxy warned that exploitation was ongoing and said it had sent roughly 600 suspected attacker holding addresses to federal investigators, compliance teams, and independent cyber investigators.

Coinkite says it must assume somebody used artificial intelligence.

Coldcard gave the same warning Sunday: "The threat remains real and ongoing".

If your Coldcard generated the seed words for your wallet on affected firmware, do not assume that installing an update makes the existing wallet safe. It doesn't. Coinkite, the company behind Coldcard, says users must install corrected firmware, create an entirely new seed, verify it, and move their Bitcoin.

If that's you, move it carefully. Panic is how a security emergency becomes a second security emergency.

That's the first lesson for us all.

What a Coldcard actually does

Bitcoin never sits inside a Coldcard. The coins remain on Bitcoin's public ledger. The device protects the private keys that authorize a transaction, while a 12- or 24-word seed phrase is the master backup from which those keys can be recreated. Whoever can reconstruct that seed can spend the money. The Coldcard documentation explains that its devices generate BIP-39 seeds and derive wallets from them.

Coldcard appealed to the sort of Bitcoin owner who takes security seriously. It is Bitcoin-only, which keeps the codebase narrower. It can sign transactions while separated from an internet-connected computer, passing a partially signed Bitcoin transaction by MicroSD card or QR code. Its firmware can be inspected, and its current models use dedicated secure-element chips to guard secrets. Those features are the core of Coinkite's security pitch, and they address real risks.

An air gap helps prevent malware on a laptop from reaching into the signing device and stealing a private key. The Coldcard can examine and sign a transaction without handing that key to the online machine. Signed transaction data comes back across the gap; the private key does not. That is how the company's offline signing workflow is designed.

The air gap did not stop this attack.

The attacker did not need to connect to the Coldcard, crack its PIN, break into a safe, intercept a MicroSD card, or trick the owner into approving a transaction. The vulnerable wallets were in trouble from the moment their seed phrases were created.

The keys looked random. They weren't random enough.

Bitcoin security depends on numbers so large and so unpredictable that guessing the right one is, for all practical purposes, impossible. A properly generated Coldcard seed was intended to have at least 128 bits of entropy. Think of entropy as the size of the field an attacker must search. At 128 bits, the field is absurdly large.

Coinkite now estimates that affected Mk2 and Mk3 seeds had roughly 40 bits of effective entropy. Later Mk4, Mk5, and Q devices mixed in additional material, but the company estimates that affected seeds from those models reached only about 72 bits. Coinkite published those preliminary figures in its technical account of the bug. Block's independent engineering analysis is even less comforting: On later devices, only 32 bits from the secure-element digest reached the software generator's state, and hashing the resulting output could not manufacture entropy that was never there.

RELATED: Your private chatbot data is at risk. Here's what to watch for

Moor Studio/Getty Images

Here is the short version. In March 2021, Coinkite changed the code used to create wallet seeds while integrating the same elliptic-curve library used by Bitcoin Core. The cryptographic library was sound. The plumbing was not. A call that was supposed to reach the Coldcard's hardware random-number generator instead resolved to MicroPython's deterministic software fallback, seeded largely with a device identifier and timing values. Coinkite says the vulnerable change reached seed generation in its 4.x firmware; Block traces the underlying code change to March 1, 2021.

The software fallback supplied the rng_get() function the build expected, with the same signature as the intended implementation. The hardware code was present in the finished firmware, so earlier reviews confirmed that it existed. They did not verify that the seed-generation path actually reached it. A preprocessor check also asked whether a setting existed, not whether the setting was enabled. Nothing in the build process caught the mismatch, and seed creation kept calling the deterministic fallback. Coinkite's explanation is unusually candid about how its review missed the failure.

That's our second lesson. Even a savvy company doesn't inherently rise to the security of the tech.

The code was available for inspection from the start. Coldcard's March 2021 announcement even promoted reproducible builds that let developers compare the published source with the firmware binary. The vulnerable seed path remained in released products for more than five years.

With the search space cut down, an attacker could generate candidate seeds offline, derive their Bitcoin addresses, and compare them with the public blockchain. A match reveals a spendable key. No contact with the victim is required. Block describes a wallet address or public key as a validation oracle for candidate seeds.

Coinkite says it must assume somebody used artificial intelligence to inspect old versions of its public firmware and find the flaw. The company also says it had recently asked a leading AI model to review the code, and that model missed the bug.

Our third lesson is that all "leading" AI models are not the same.

After the bug became public, an Aug. 2 Reddit post supplied a vivid but limited demonstration. The poster said Claude Code found the broken path after receiving only a generic instruction to check for vulnerabilities and thinking for eight minutes. The screenshot shows the model distinguishing the correct hardware TRNG path from the broken ngu.random software PRNG path. It does not show the full prompt, model version, checked-out firmware revision, internet permissions, or complete session transcript. The post supports rapid AI-assisted reproduction, not a claim that Claude Code discovered the original exploit or that the thief used it.

Bitcoin Optech separately reports that several developers reproduced the attack with help from frontier AI models. AI involvement is plausible. The attacker's identity and tools remain unknown.

'I did everything right'

The ledger gives us totals. It does not show the years people spent building those balances.

Canadian entrepreneur Jonathan Goodman says 18.25245043 Bitcoin disappeared from his wallets between 9:36 and 9:43 p.m. on July 29. His Coldcard sat in a bank safe-deposit box, he said, while his backup keys were kept in a different safe. The device had never been connected to the internet. When he opened a watch-only wallet from his cottage, he saw the withdrawals. Goodman put the loss at more than $1.6 million Canadian and said he was filing reports with police and the Ontario Securities Commission.

"Perhaps the hardest part about this is that I did everything right," he wrote.

Bitcoin to 1 Mil (@1MillionBTC2025) said 1.3 Bitcoin accumulated over seven years was gone; the post included no transaction record. Bitcoin commentator Oliver Velez said he followed "every accepted rule of Bitcoin self-custody" and still lost a material amount. These are public self-reports, not independently verified claims. They arrived amid the large pattern of theft Galaxy had already found on-chain.

One particularly grim account began on Reddit and then spread across X. A 39-year-old poster said he had spent eight years accumulating two Bitcoin as protection against inflation and hoped the money would provide a cushion before age 50. The Reddit post did not include a transaction ID, and commenters questioned its authenticity, so it should be treated as unverified. The story spread because it resembled losses that were already visible on-chain.

RELATED: Are you inhaling microplastics?

solar22/Getty Images

The rush to escape creates its own hazards. X user lunymoon13 said he moved funds toward a temporary hot wallet after hearing the warning, sent a successful test, and then discovered the remaining stack had been drained. The cause of that loss has not been established. Even with the clock running, verify the destination and backup before moving the rest.

The backlash includes people who did not lose funds. Chris Masterjohn said he had bought two Coldcards but never used them. Responding to a developer's review of the commit history, he wrote, "Will never touch the company again." The same post blamed competitive pettiness for the code change. The developer analysis documents the broken call path; it does not establish that motive.

Who is affected?

The important question is where the seed was created, not which device holds it today. Moving a weak Coldcard-generated seed into a Ledger, Trezor, software wallet, or newer Coldcard does not strengthen it. Block specifically warns that an exported seed remains vulnerable after import into another wallet.

Coinkite's latest advisory identifies Mk2 or Mk3 firmware 4.0.1 through 4.1.9 as affected. Block's engineering team includes version 4.0.0, which Coinkite publicly released on March 17, 2021, in the vulnerable range. That discrepancy should be resolved in the promised formal review. Until then, the safe course is to treat any Mk2 or Mk3 seed generated on a 4.x release before fixed version 4.2.0 as potentially affected. Also affected are Mk4 or Mk5 seeds generated before standard version 5.6.0 or Edge version 6.6.0X, and Q seeds generated before standard version 1.5.0Q or Edge version 6.6.0QX. Coinkite initially said the newer models were unaffected, then expanded the warning after further investigation. Its current advisory supersedes that early assessment.

There are two important qualifications. Coinkite says a seed created with at least 50 fair, independent, private dice rolls has at least 128 bits of outside entropy and is not endangered by this particular bug alone. A strong, unique BIP-39 passphrase also puts another barrier between an attacker and the funds. A short quotation, reused password, patterned phrase, or one clever dictionary word does not count. Even users with strong passphrases are being told to replace affected seeds as soon as practical.

The device PIN is not that passphrase. It protects access to the physical Coldcard. It does nothing against somebody who has reconstructed the seed elsewhere. Coinkite's advisory makes the same distinction.

What affected Coldcard owners should do now

The blunt answer: Move the Bitcoin out of the wallet controlled by the affected Coldcard seed. Installing new firmware does not repair that seed. A strong passphrase may buy time, but it is not a repair either. Coinkite says the money must move to an entirely new seed.

Use Coinkite's official advisory, not a link in an email, direct message, or reply. The emergency creates perfect working conditions for phishing and fake "recovery" services.

The cleanest exit is a new seed generated on a different hardware wallet with current firmware. Do not import the old Coldcard words. That carries the vulnerability into the new device. Even Coldcard's Sunday statement pointed customers toward Bitkey, Ledger, Trezor, Jade, and BitBox.

Write down and verify the new backup. Check the wallet fingerprint and receive address on the new hardware screen. Send a small test transaction. Once it arrives at the correct wallet, move the rest. Keep the old backup until the transfer is confirmed, but never enter it into a website or give it to anyone offering help.

Do not throw away the affected Coldcard. The company says the device could become important if stolen funds are recovered. That is not an announcement that recovery has happened. Keep the device secure.

Coinbase as an emergency bridge

Public threads are full of shaken owners asking whether they should park their Bitcoin on Coinbase or another exchange. If the choice is between leaving money under a seed that thieves are actively searching and using an established exchange while a replacement wallet arrives, temporary exchange custody may be the less dangerous option.

It is still a trade. In a hosted Coinbase.com account, Coinbase controls the private keys. Coinbase Wallet is a different, self-custody product, so make sure you know which one you are using. Coinbase's agreement says withdrawals can be subject to outages, downtime, and company policies, and Bitcoin held there does not have FDIC or SIPC protection.

Anyone choosing Coinbase should secure the account before sending money. Coinbase calls two physical security keys its highest-security two-factor setup. Get the Bitcoin deposit address from the official app or a manually typed Coinbase URL, verify the network and address, send a test, and then move the balance. Do not follow deposit instructions from an email, text message, phone call, or direct message.

What owners of other hardware wallets should do

Do not move Bitcoin merely because another company's hardware wallet failed. Ask where your seed came from.

If Ledger, Trezor, Jade, BitBox, or another wallet generated the seed and that seed never came from an affected Coldcard, this particular bug does not apply to it. Check for notices from your own manufacturer, use only its official firmware tools, and keep the seed backup offline. Do not type the words into a computer or website to "check" them.

If an affected Coldcard created the seed and you later imported it into another device, move the Bitcoin. Changing hardware does not add randomness to an old seed.

RELATED: Thousands of lawyers caught using AI — and it's only getting worse

DAVID MAIALETTI/POOL/AFP/Getty Images

Multi-signature owners have one more question: Could the affected Coldcard keys meet the spending threshold without the other devices? Galaxy says wallets where the answer was no were protected from this attack, but the weak Coldcard key should still be rotated. Do not build a complicated multi-signature wallet in the middle of a panic. For large balances, though, a planned setup using keys from different manufacturers prevents one broken generator from holding the entire stack hostage.

If the Bitcoin is already gone, preserve the wallet addresses, transaction IDs, amounts, dates, screenshots, device and firmware details, and records showing how you acquired the coins. Report the theft to local law enforcement and to the FBI's Internet Crime Complaint Center. The FBI says transaction hashes, receiving addresses, amounts, and timestamps are the most useful details, and it warns that services promising to recover stolen cryptocurrency for an up-front fee may be running a second scam. Recovery is uncertain, but a prompt, detailed report gives investigators something to trace.

An air gap is not magic

The published analyses describe a failure in Coldcard's secret generation, not a break in Bitcoin's ledger or signature algorithm. The product failed at the most basic point in the custody chain: making a secret that nobody else can guess.

"Don't trust, verify" sounds good on a T-shirt. In practice, verifying this bug required following a function call across libraries, build settings, and linker behavior. Almost no ordinary customer can do that, which is why customers bought the little plastic signing device in the first place.

Final lesson? Public code does not inspect itself. An air gap protected the secrets from the internet. It could not save secrets that were too predictable at birth.

Coinkite has released fixes and migration instructions. In its Sunday statement, the company said it halted shipments, destroyed its remaining Coldcard inventory manufactured with vulnerable firmware, and had begun working directly with customers. Its lawyers may coordinate with law enforcement, and a technical postmortem is coming. The statement did not say that stolen funds had been recovered or describe a reimbursement plan.

The company still owes customers a full account of how this passed review, how many people were harmed, and what it plans to do for those who trusted its product with the savings of a lifetime.

Check where your seed came from. If affected Coldcard firmware created it, move the Bitcoin to a new seed created somewhere else. If another wallet created it, do not turn one company's failure into a rushed mistake.