$594M BTC Stolen in Coordinated Sweep Linked to Coldcard Hardware Wallets

A coordinated sweep emptied hundreds of wallets on July 30, moving roughly $594 million in BTC from about 500 single-signature addresses within approximately 25 minutes. The transfers appeared to target wallets with a shared technical weakness.

Researchers estimated that between 1,082 and 1,196 addresses may have been affected during a period of about 41 minutes. A custom dashboard called Coldcard Sweep Watch placed the total at $71.1 million.

The affected addresses were linked by one important detail: Their recovery seeds had been created on Coldcard hardware wallets manufactured by Canadian company Coinkite.

Coldcard Finds a Broken Randomness System

The flaw involved the process used to generate random data. Secure wallets depend on high-quality randomness so that their recovery seeds cannot be guessed. On the most seriously affected Mk3 devices, researchers estimated that the seed may have contained only about 40 bits of effective randomness instead of the intended 128 bits.