Key Takeaways
- • At least 15 separate attackers exploited a Coldcard hardware wallet vulnerability, according to Galaxy Digital Head of Research Alex Thorn, indicating a coordinated or widely-known exploit rather than an isolated breach.
- • Total Bitcoin theft from the Coldcard exploit reached approximately 1,816 BTC valued at $114 million, with earlier reports citing losses between $70.2 million and $116 million across multiple attack waves.
- • The vulnerability stemmed from a firmware flaw introduced in March 2021 affecting five Coldcard models, impacting at least 1,196 wallets across multiple attack waves completed in timeframes as brief as 41 minutes.
- • Coldcard, manufactured by Canadian firm Coinkite, is a hardware device designed to store Bitcoin offline as "cold" storage for long-term holders, making this breach particularly significant for institutional and high-net-worth Bitcoin holders relying on offline custody solutions.
- • The exploit remained active with ongoing Bitcoin transfers from stolen funds, indicating attackers retained access to compromised wallets and continued to move cryptocurrency post-theft.
Summary
A significant security breach affecting Coldcard hardware wallets has resulted in the theft of approximately 1,816 BTC ($114 million) through exploitation of a firmware vulnerability, according to analysis by Galaxy Digital and Onchain Lens. Galaxy Digital's Head of Research Alex Thorn identified at least 15 different attackers as having participated in the exploit, suggesting the vulnerability became widely known or shared among multiple threat actors rather than representing a single sophisticated operation.
The Coldcard hardware wallet, manufactured by Canadian technology firm Coinkite, is specifically designed to keep Bitcoin keys offline—marketed as one of the safest storage solutions for long-term cryptocurrency holders. The breach is particularly notable given this intended security posture. The underlying cause was a firmware flaw introduced in March 2021 that weakened the wallet seed generation process across five Coldcard models. Security researchers determined the flaw impacted at least 1,196 affected wallets.
The attack unfolded across multiple waves, with one documented sweep of 1,082.65 BTC (approximately $70.2 million) completed in just 41 minutes, demonstrating both the speed and scale at which attackers exploited the vulnerability. Reports indicate the total theft figure of $114 million represents cumulative losses across all attack phases, though earlier estimates ranged between $70.2 million and $116 million as the breach was still developing. The incident prompted urgent warnings to Coldcard owners to immediately transfer their funds from potentially compromised wallets.
Critical to the ongoing threat assessment, evidence suggests the attackers retained control of stolen Bitcoin and continued to move funds post-theft, indicating the vulnerability remained exploitable and that attackers maintained access to compromised wallet keys. This active movement of stolen cryptocurrency underscores both the severity of the initial compromise and the continued operational risk for affected users.
The Coldcard hardware wallet, manufactured by Canadian technology firm Coinkite, is specifically designed to keep Bitcoin keys offline—marketed as one of the safest storage solutions for long-term cryptocurrency holders. The breach is particularly notable given this intended security posture. The underlying cause was a firmware flaw introduced in March 2021 that weakened the wallet seed generation process across five Coldcard models. Security researchers determined the flaw impacted at least 1,196 affected wallets.
The attack unfolded across multiple waves, with one documented sweep of 1,082.65 BTC (approximately $70.2 million) completed in just 41 minutes, demonstrating both the speed and scale at which attackers exploited the vulnerability. Reports indicate the total theft figure of $114 million represents cumulative losses across all attack phases, though earlier estimates ranged between $70.2 million and $116 million as the breach was still developing. The incident prompted urgent warnings to Coldcard owners to immediately transfer their funds from potentially compromised wallets.
Critical to the ongoing threat assessment, evidence suggests the attackers retained control of stolen Bitcoin and continued to move funds post-theft, indicating the vulnerability remained exploitable and that attackers maintained access to compromised wallet keys. This active movement of stolen cryptocurrency underscores both the severity of the initial compromise and the continued operational risk for affected users.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.