Coldcard Hack Rattles Self-Custody Community with $620M ETF Inflows

A recent firmware vulnerability in older Coldcard hardware wallets led to significant inflows into spot Bitcoin ETFs, totaling $620 million. The issue affected seed phrase generation, allowing attackers to reconstruct private keys and draining an estimated $89 million to $116 million from over 5,200 wallet addresses.

The breach occurred on July 30, 2026, when Coinkite disclosed a firmware vulnerability affecting older Coldcard models. This reduced the entropy used during seed phrase generation to approximately 40 bits, making it mathematically feasible for an attacker to reconstruct private keys from scratch.

Newer Coldcard models were less affected by the flaw, but still experienced some exposure. Despite the breach, Bitcoin's price reaction was muted, dipping only about 3% before stabilizing close to prior levels.