Coldcard Seed-Flaw Hack Drains 1,082 Bitcoin From 1,196 Cold Wallets

A rare hack has struck cold wallets designed to remain offline.

CoinDesk reported on August 1 that Galaxy Research wrote in a post on X, formerly Twitter, that 1,082 Bitcoin were stolen from 1,196 Coldcard wallets over about 40 minutes on July 30.

Galaxy Research said the attack did not compromise wallets in the way exchange hacks or phishing scams typically do. Instead, the attacker exploited a vulnerable seed-generation process to derive private keys.

A seed phrase is the random sequence that generates all wallet addresses and private keys. In a properly functioning hardware wallet, the seed is created through a dedicated random-number generator and cannot be predicted. In the affected firmware, however, a configuration error generated specific seed phrases.

Using that flaw, the attacker generated possible seeds on their own equipment and matched the Bitcoin addresses created from those seeds against the blockchain to identify funded wallets. The entire process took place on the attacker's devices, so victims' wallets did not need to be connected to the internet or physically stolen.

Galaxy Research said the incident did not target specific users. Rather, it described the breach as a large-scale scan that systematically searched for vulnerable seeds. It also advised users running the affected firmware to move their assets to new wallets to prevent additional losses.

The incident is also quickly denting Bitcoin sentiment. Santiment, an on-chain analytics firm, wrote in a post on X on August 1 that the Coldcard firmware vulnerability had shaken confidence in self-custody and sharply worsened sentiment in the Bitcoin market.

Santiment said positive commentary on Bitcoin currently stands at 0.58 posts for every negative one. That reflects deeper fear than during earlier periods of major market stress, including this year's geopolitical tensions, the collapse of FTX and the collapse of Mt. Gox.