Coldcard Wallets Hit by $88.6M Seed Generation Flaw

The estimated losses linked to a Coldcard seed-generation flaw have risen to an alarming $88.6 million, after Galaxy Research identified a third suspected theft cluster.

A total of 1,367.05 BTC has been drained from wallets across 4,585 addresses, with attacker-controlled endpoints holding 1,366.3865 BTC that remains unspent on-chain.

The attack did not require physical access, malware, or a stolen recovery phrase. Instead, the weakness began when affected devices generated the secret controlling each wallet using MicroPython's deterministic fallback generator, rather than the intended hardware random-number generator.

This error reduced the unpredictability protecting newly created wallets, leaving them vulnerable despite air-gapped storage and offline backups.