Coldcard Wallet Bug Triggers $89M Bitcoin Movement

Coldcard's hardware wallet has been plagued by a significant security issue, resulting in a major Bitcoin movement that has distorted market signals. On July 30, Coinkite warned users that wallets generated with affected Coldcard firmware could be drained due to a software error producing seed phrases with reduced randomness.

The security incident led to three suspected attack waves targeting 4,585 addresses and draining 1,367.05 BTC, worth approximately $89 million. The Bitcoin associated with these attacks remains in attacker-controlled addresses, according to Alex Thorn, Galaxy Digital's head of firmwide research.

The crisis has pushed potentially exposed users to move their Bitcoin before attackers reach it. Although Coinkite has released fixed firmware for affected models, existing affected seed phrases cannot be repaired through an update, leaving holders to generate new wallets and transfer their funds to secure addresses.