Coldcard Hack Losses Top 1,359 BTC, Erasing About $85 Million

More than 1,359 Bitcoin has been stolen in a hack tied to hardware wallet maker Coldcard, according to on-chain data. As losses mounted, Binance co-founder Changpeng Zhao urged users of vulnerable wallets to act immediately.

On-chain tallies on Aug. 1 showed 1,359.1829 Bitcoin linked to wallets generated by Coldcard had likely been drained. The stolen holdings were worth about $85.32 million. The total has continued to climb as additional affected wallets are identified.

The hack occurred because some Coldcard firmware generated seed phrases without sufficient randomness. Attackers are believed to have narrowed the possible seed phrase combinations, inferred private keys and then withdrawn the Bitcoin held in those wallets.

Zhao wrote on X that a firmware update alone cannot fix vulnerabilities in wallets that have already been created. “Even if developers patch the bug, they can’t repair wallets generated earlier,” he wrote. “Until users take action themselves, those wallets remain exposed to hackers.”

He added that the nature of air-gapped devices, which are not connected to the internet, makes a rapid response more difficult. Developers have limited ways to remotely apply security patches to such devices or send warnings directly to users.

“I support self-custody, but users also have to bear the responsibility that comes with it,” Zhao wrote. Users whose seeds were created with the vulnerable firmware need to do more than install the corrected firmware. They also need to generate a new seed and move their assets.