Coldcard Hardware Wallets Breached for $38M in Bitcoin

A major security breach affected Coldcard hardware wallets on July 31, draining $38 million in bitcoin from approximately 500 devices in just 25 minutes. The attack exploited a seed generation flaw that had been present since March 2021 and was not detected by the manufacturer's own AI review.

The bug reduced the effective entropy of Mk3 seeds from 128 bits to around 40 bits, making private keys guessable through brute force computation. Coinkite estimates that every current Coldcard model is affected to some degree, with Mk4, Q, and Mk5 seeds estimated at roughly 72 bits of entropy instead of 128.

The incident raises fundamental questions about whether hardware wallets can be trusted as the sole custodial layer for significant bitcoin holdings. Block, Trezor, and Ledger have confirmed that their products are unaffected by the bug.