Coldcard Firmware Flaw Drained 1,367 BTC Across 4,585 Addresses

A firmware vulnerability in Coldcard hardware wallets allowed attackers to reconstruct private keys and drain funds across thousands of addresses, according to research from Galaxy Research that identified three distinct waves of exploitation totaling 1,367.05 BTC across 4,585 compromised addresses.

The flaw centered on seed generation. A weakness in the wallet's firmware degraded the randomness used when generating seed phrases, meaning the private keys produced were not cryptographically secure. Attackers who understood the vulnerability could reverse-engineer the key derivation process and reconstruct private keys without ever physically accessing the device. That class of attack is particularly dangerous because it leaves no obvious trace: affected users see no unusual activity until funds are already gone.

Galaxy Research's analysis broke the exploit into three waves, suggesting either multiple threat actors using the same vulnerability or a single actor operating in coordinated phases. The research did not attribute the attacks to a specific group. Coldcard, manufactured by Coinkite, is one of the most widely used air-gapped hardware wallet solutions among self-custody advocates, making the scope of the compromise notable even if the 1,367 BTC affected represents a fraction of total cold storage holdings globally.

Changpeng Zhao, co-founder of Binance, responded publicly to the incident, framing it as confirmation of a principle he has long advocated.

"No crypto wallet is fail-proof."

Changpeng Zhao (CZ), co-founder of Binance

Zhao followed that with a concrete recommendation: "spreading funds across independent wallets can reduce losses when one device or seed is compromised." The logic is straightforward. A single-wallet strategy concentrates risk. If one device carries a firmware flaw, one compromised seed phrase, or one supply chain intervention, the entire holding is exposed. Distributing funds across multiple independent wallets, ideally from different manufacturers using different firmware stacks, caps the damage from any single point of failure.

The advice is sound in principle, but it carries real operational costs. Managing multiple hardware wallets means tracking multiple seed phrases, multiple firmware update cycles, and multiple recovery procedures. For less experienced users, that complexity introduces its own failure modes: lost seeds, mixed-up backups, or errors during recovery that result in self-inflicted losses. The security gain from diversification is real; so is the risk of human error at scale.

This is not the first time a hardware wallet manufacturer has faced scrutiny over a fundamental security flaw. Ledger faced sustained criticism beginning in 2018 over supply chain concerns, and subsequent years brought additional firmware-related disclosures across the hardware wallet industry. Each incident follows a similar arc: discovery, disclosure, firmware patch, and an industry-wide conversation about whether cold storage is as secure as its reputation suggests. The Coldcard incident fits that pattern, with one meaningful difference. Seed generation vulnerabilities strike at the foundational assumption of hardware wallet security, which is that the device produces genuinely random, unguessable keys. A flaw in that step undermines everything built on top of it.

Hardware wallets still offer substantially stronger security than hot wallets or funds held on centralized exchanges. The attack surface for an air-gapped device is narrower than for software wallets exposed to the internet, and the Coldcard vulnerability appears to affect a specific firmware version rather than the entire product line. Firmware patches can close the specific flaw. What they cannot do is retroactively secure keys already generated under the compromised code. Users who created wallets during the affected period need to migrate funds to freshly generated addresses using patched or alternative hardware.

The broader context matters here. An analyst described the current market as one "struggling substantially, now with the exploit of one of the most popular cold-storage solutions on the market." That framing, pairing the Coldcard incident with the proliferation of scam memecoins, reflects a real anxiety in the self-custody space: that the tools and practices meant to protect users are themselves becoming attack surfaces. Those are distinct problems with distinct solutions, but they share a common thread. Both exploit the gap between perceived security and actual security.

For users holding meaningful amounts of Bitcoin in cold storage, the practical response is threefold. First, verify which firmware version was running when keys were generated and check Coinkite's official disclosure for affected version ranges. Second, if there is any exposure, generate new wallets using patched firmware or alternative hardware and migrate funds. Third, consider whether a multi-wallet distribution strategy, whatever its operational overhead, is appropriate given the size of holdings at risk. CZ's recommendation is not new, but the Coldcard incident gives it renewed weight. The question is not whether cold storage is secure in the abstract. It is whether any single device, from any manufacturer, should be trusted as the sole custodian of a significant holding.