Coldcard firmware flaw leads to $38 million bitcoin wallet drain
An attacker exploited a randomness vulnerability in certain Coldcard hardware wallets to drain 594 BTC, worth approximately $38 million, across 500 single-signature accounts in under 30 minutes. The flaw, introduced in March 2021 firmware, forced key generation to rely on predictable nonsecret chip data rather than true hardware randomness. Coinkite urged affected users to transfer funds, while market prices for bitcoin remained stable above $64,000 despite the swift, widespread theft.
Key takeaways
- 1Attackers stole 594 BTC worth $38 million from 500 Coldcard wallets within 25 minutes.
- 2The vulnerability stems from a firmware bug introduced in Coldcard version 4.0.0 in March 2021.
- 3Newer Coldcard models including Mk4, Mk5, and Q appear unaffected by the flaw.
Coins in this story
Why it matters
This vulnerability highlights the critical risk of relying on single-signature hardware wallets without checking key generation safety. Self-custody investors should verify their device firmware history and consider multi-signature setups to prevent single points of failure.
Discussion
Related stories
Wintermute report warns future altseasons will produce fewer winning tokens
Institutional investors accounted for a record 72% of Wintermute's spot over-the-counter flow in the first half of 2026. This capital concentration in a small group of digital assets suggests broad altcoin rallies are ending. Market data shows the top 10 altcoins now command 80.5% of non-Bitcoin market capitalization. Institutional trading surges in smaller tokens fade after one day, leaving long-tail digital assets struggling for liquidity across major exchanges.
Coinkite warns Coldcard Mk3 users after $38 million Bitcoin sweep
Canadian hardware maker Coinkite urged Coldcard Mk3 users to migrate funds following a potential seed-generation vulnerability in firmware version 4.0.1 through version 5.0.3. The warning comes as security analysts examine an unexplained sweep of 594.48 BTC, worth $38.3 million, executed across 500 transactions within a three-block window. Experts suspect low entropy in key generation allowed an attacker to brute-force affected wallets, prompting urgent calls for users to move their assets.
Strategy reports $8.2 billion Q2 loss following bitcoin markdown
Strategy reported an $8.2 billion Q2 net loss due to an $8.32 billion unrealized bitcoin markdown under fair-value accounting. The company now holds 843,775 bitcoin worth $54.8 billion, below its $63.7 billion cost basis. To reassure investors, Strategy established a $3.75 billion cash reserve to cover two years of dividend payments and sold $218.4 million in bitcoin under a new monetization program, marking a rare shift from its pure accumulation strategy.