Key Takeaways
- • More than 1,700 bitcoins have been stolen from Coldcard hardware wallet users due to a firmware flaw affecting five wallet models that weakened seed entropy dating to 2021, resulting in aggregate losses exceeding $70 million to $100 million.
- • Alex Thorn, head of firmwide research at Galaxy Digital, has interviewed over 130 victims and confirmed that most affected users followed proper self-custody protocols, indicating the vulnerability was not user error but a systemic hardware wallet defect.
- • Thorn stated on Bloomberg Crypto that Bitcoin as an asset will "survive" the Coldcard hack, distinguishing this security breach from other cryptocurrency attacks by noting that victim identification and attacker attribution remain challenging without direct victim reports.
- • The Coldcard exploit represents a unique attack vector in the hardware wallet space, with hackers systematically draining funds from multiple wallets linked to the same seed generation vulnerability rather than through traditional attack methods.
Summary
A significant security vulnerability in Coldcard hardware wallets has resulted in the theft of over 1,700 bitcoins from users who implemented proper self-custody practices. According to Galaxy Digital's analysis, the breach stems from a firmware flaw affecting five Coldcard models that compromised seed entropy generation, with the defect originating from 2021 code. Aggregate losses range from $70 million to $100 million based on available victim data, though the full scope may remain incomplete due to difficulty identifying all affected parties.
Alex Thorn, head of firmwide research at Galaxy Digital, has taken a leading analytical role in understanding the hack's scope and impact. Through interviews with more than 130 victims, Thorn confirmed that the majority of affected users had followed industry best practices for securing their private keys and managing self-custody—meaning the breach resulted from a hardware manufacturer defect rather than user negligence. This distinction is significant for the institutional investor community, as it highlights systemic risks in hardware wallet infrastructure that affect even sophisticated users implementing proper protocols.
Addressing the broader market implications on Bloomberg Crypto, Thorn emphasized that Bitcoin as an asset class will "survive" the Coldcard incident. He characterized this attack as fundamentally different from previous cryptocurrency security breaches, noting that the nature of the exploit—leveraging the seed generation vulnerability—creates challenges in identifying all attackers and victims without direct victim reports. This opacity has complicated efforts to trace stolen funds and implement comprehensive remediation strategies.
The incident underscores critical vulnerabilities in the hardware wallet ecosystem, an area institutional investors and family offices rely upon for secure cryptocurrency custody. The 2021-era firmware flaw that persisted undetected until 2026 suggests potential gaps in vendor security practices and firmware update protocols. As losses continue to accumulate, the breach demonstrates that hardware-based security solutions, traditionally considered the gold standard for self-custody, require ongoing scrutiny and prompt vulnerability disclosure mechanisms to protect institutional capital.
Alex Thorn, head of firmwide research at Galaxy Digital, has taken a leading analytical role in understanding the hack's scope and impact. Through interviews with more than 130 victims, Thorn confirmed that the majority of affected users had followed industry best practices for securing their private keys and managing self-custody—meaning the breach resulted from a hardware manufacturer defect rather than user negligence. This distinction is significant for the institutional investor community, as it highlights systemic risks in hardware wallet infrastructure that affect even sophisticated users implementing proper protocols.
Addressing the broader market implications on Bloomberg Crypto, Thorn emphasized that Bitcoin as an asset class will "survive" the Coldcard incident. He characterized this attack as fundamentally different from previous cryptocurrency security breaches, noting that the nature of the exploit—leveraging the seed generation vulnerability—creates challenges in identifying all attackers and victims without direct victim reports. This opacity has complicated efforts to trace stolen funds and implement comprehensive remediation strategies.
The incident underscores critical vulnerabilities in the hardware wallet ecosystem, an area institutional investors and family offices rely upon for secure cryptocurrency custody. The 2021-era firmware flaw that persisted undetected until 2026 suggests potential gaps in vendor security practices and firmware update protocols. As losses continue to accumulate, the breach demonstrates that hardware-based security solutions, traditionally considered the gold standard for self-custody, require ongoing scrutiny and prompt vulnerability disclosure mechanisms to protect institutional capital.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.