Coldcard Exploit Tops $100M With 1,596 Bitcoin Stolen as Attacks Continue

An active security exploit targeting Coldcard hardware wallets has drained at least 1,596 Bitcoin, with confirmed losses exceeding $100 million. Coldcard has issued an official advisory urging users to move funds out of affected devices immediately.

The breach is unfolding in waves. Analysts tracking the incident warn that a fourth wave of attacks could push total losses to $130 million. The exploit's multi-stage structure distinguishes it from isolated, one-time incidents that have historically affected hardware wallet manufacturers. This is an ongoing drain, not a postmortem.

Coldcard has not publicly detailed the attack vector as of Tuesday, leaving users uncertain about which devices or firmware versions are at risk. The company's guidance to "carefully move funds" implies that the exploit is not universally limited to a single configuration, though security researchers have suggested it may be tied to specific firmware versions rather than a flaw in the hardware itself. That distinction matters: a firmware vulnerability can be patched; a hardware flaw in silicon is far harder to remediate at scale.

The scale of the breach is significant by any measure in the hardware wallet space. The Ledger Connect Kit exploit in late 2023 exposed users of multiple DeFi protocols to front-end injection attacks, but losses were contained to roughly $600,000 before the malicious code was pulled. The Coldcard incident, at nine figures and still climbing, represents a different order of magnitude. It is shaping up to be one of the largest security failures ever recorded against a dedicated hardware wallet product.

The self-custody community is processing the news with a mix of alarm and nuance. Hardware wallets, including Coldcard, are designed around the premise that private keys never leave the device, making remote theft theoretically impossible without physical access or a compromised signing environment. The fact that an exploit of this scale is occurring challenges that assumption in ways the industry will need to answer for. Critics of the self-custody model are pointing to the incident as evidence that "not your keys, not your coins" cuts both ways: full control carries full responsibility for security failures that most retail users are not equipped to anticipate.

Defenders of self-custody push back on that framing. Exchange collapses, from Mt. Gox to FTX, have destroyed far more value than any hardware wallet exploit on record. Counterparty risk at custodial institutions remains a structural vulnerability that no firmware patch can fix. The more measured takeaway from this incident is not that hardware wallets are broken, but that the security model requires active maintenance: firmware updates, verified purchase channels, and awareness of phishing vectors targeting signing sessions.

What remains unclear is how attackers gained the leverage needed to move funds from devices that are, by design, air-gapped during key storage. Possibilities under discussion in security circles include supply chain compromise, malicious firmware distributed through unofficial channels, or an exploit in the transaction signing flow that manipulates what users approve on-screen. Until Coldcard publishes a technical post-mortem, the precise mechanism is unconfirmed.

For Coldcard users, the immediate priority is straightforward: follow the company's advisory, move Bitcoin to a freshly generated wallet on a verified clean device, and do not sign any transactions on a potentially affected Coldcard until the attack vector is publicly identified and patched. Users who purchased devices through third-party resellers rather than directly from Coinkite, Coldcard's parent company, should treat their hardware with heightened suspicion.

The broader hardware wallet market will face questions in the coming days. Competing manufacturers including Trezor, Ledger, and Foundation Devices will likely see increased scrutiny of their own security architectures, even if this exploit is entirely specific to Coldcard. Institutional self-custody programs, which have grown substantially alongside Bitcoin ETF adoption, will need to assess whether their operational security procedures adequately account for firmware-level attack surfaces.

At 1,596 Bitcoin and rising, the incident is already a landmark event in cryptocurrency security history. The final number, whenever the exploit is contained, will define how the industry thinks about hardware wallet risk for years.