The firmware flaw in Coldcard hardware wallets has now drained about 1,367 BTC, worth roughly $89M, from 4,585 wallets across three waves, per Galaxy Research.

A Coldcard is a physical device for holding bitcoin. A 2021 coding mistake quietly weakened the randomness of the seeds it created, so keys for thousands of wallets became guessable. Attackers computed those keys and swept the coins remotely, with the physical devices never touched at all.

The bug dropped seed entropy to about 72 bits instead of 128, making keys enumerable offline. It affects seeds generated on Mk3 (firmware 4.0.1+), and Mk4, Q and Mk5 before their fixes, not every Coldcard. Coinkite urges owners to move funds to a fresh seed on patched firmware. The total is a Galaxy Research estimate, cumulative and still climbing as of August 2, and there is no token involved.