Coldcard Bitcoin Theft Surges Past $88M as Third Attack Wave Emerges

Coldcard Bitcoin theft has hit $88.6 million as a third attack wave emerges. Galaxy Research identified a cluster of 207.7294 BTC in suspected hacks tied to Coldcard seeds, pushing estimated losses far above an initial figure of $38 million.

The weakness behind the attacks lies in the seed generation process. A 2021 software integration redirected seed creation to MicroPython's deterministic fallback generator instead of the intended hardware random-number generator. This reduced the unpredictability protecting newly created wallets, leaving them vulnerable despite air-gapped storage and offline backups.

Affected users must create a new seed on fixed firmware, verify the backup and receiving address, and send a small test transaction before moving the remaining balance. Seeds created with at least 50 fair, independent, private dice rolls are not considered exposed by this flaw alone.