Coldcard Bitcoin Hardware Wallets Hit By $30 Million Flaw-Related Losses

Coldcard, a maker of Bitcoin hardware wallets, is facing a wave of thefts tied to a firmware flaw that went unnoticed for five years. According to Galaxy Research, a fourth attack wave hit over the weekend, moving 448.7 Bitcoin from 709 suspected victim addresses.

The total losses across all four waves are estimated at around 1,815 Bitcoin from 5,294 addresses, although this figure is not confirmed by Coinkite, police, or every wallet owner involved.

The flaw was traced back to a 2021 firmware update that swapped the true random number generator for a weaker one. Kraken's chief security officer, Nick Percoco, said the case shows hardware wallets lack independent testing standards other devices already use.

Coldcard has halted shipments and released fixed firmware, but users still must move their funds to new seeds. Coinkite destroyed affected stock and is asking users not to throw away old devices, which may help identify stolen funds later.