According to Galaxy Research, Coldcard-related thefts have exceeded $111 million, with the firm identifying 1,719 BTC stolen from about 7,300 addresses across three confirmed attack waves. As reported by AMBCrypto, investigators have discovered over 25 attack patterns across three waves, suggesting multiple threat actors exploited the vulnerability. Galaxy Research states they have many more coins they are vetting for confirmation – they think total losses likely exceed $130 million. If the suspicious but unconfirmed cases on their current list turn out to be confirmed, the total might surpass 2,300 Bitcoin. The attack began on July 30, 2025, with an attacker draining approximately 594 BTC, worth $38 million, from 500 wallets within 15 to 25 minutes.
The breach resulted from a single macro-check error introduced during a March 2021 Coldcard firmware migration, as confirmed by both Coinkite and Block's Bitcoin engineering teams. The vulnerability traces to an incorrect conditional check that caused wallet seed generation to bind to a software pseudo-random number generator called Yasmarang instead of the STM32 hardware true random number generator. Seeds created on Mk2 and Mk3 devices running affected firmware versions from 4.0.0 through 4.1.9 contain roughly 40 bits of effective entropy, with no cryptographically generated input added to the random number generator output. AI-assisted security analysis following the Coldcard disclosure has identified 85 critical-severity findings across multiple Bitcoin wallet implementations, including incorrect fallback bindings similar to the Coldcard error and insufficient reseed entropy that leaves weak software generators partially overwritten by hardware input.
Ripple CTO Emeritus David Schwartz framed the Coldcard attack as an example of outlier risk, comparing it with the 2011 collapse of MF Global where customers temporarily lost access to funds after the brokerage misused segregated money. As reported by crypto.news, Schwartz pointed to a major difference between traditional finance and crypto self-custody, noting that customers of regulated financial institutions may have access to insurance, bankruptcy proceedings, or other recovery mechanisms. Coldcard owners whose Bitcoin was stolen through compromised seeds currently have no comparable safety net. The incident has renewed debate about whether Hardware Wallets Are Still Safe, with security researchers pointing out that even air-gapped Bitcoin-only devices carry manufacturer and firmware implementation risks that users rarely account for. Chainalysis found that Canadian Bitcoin holders account for about 25% of attributable losses, with the largest single theft involving 1,159 BTC removed across seven addresses.
Coinkite has released corrected firmware for affected Coldcard models, but installing an update does not repair existing vulnerable seeds. According to Coinkite's security advisory, Mk2 and Mk3 owners who created seeds using firmware versions 4.0.1 through 4.1.9 must generate a completely new seed and transfer their Bitcoin. Users should first send a small test transaction and verify the receiving wallet before moving the remaining balance. The company has already released patched firmware for all affected Coldcard models and destroyed remaining inventory containing vulnerable versions. Kraken's chief security officer Nick Percoco has called for mandatory independent entropy testing across all hardware wallet manufacturers, citing the need for end-to-end entropy verification similar to NIST SP 800-90B and Germany's BSI AIS-31 standards. The broader pattern shows that implementation-level errors in seed generation carry equally severe risks, regardless of whether a device is air-gapped, with victims who lost funds able to report drained addresses and transaction IDs to Galaxy Research via DM at @intangiblecoins on X.
The breach demonstrates that air-gapped hardware can reduce online attack exposure without eliminating firmware, manufacturing, or seed-generation risks. For affected owners, moving funds to a newly generated wallet remains the only way to remove the immediate threat. The Bitcoin protocol was not compromised, with the theft resulting from weak wallet-seed generation, meaning Bitcoin held in wallets created through unaffected software or hardware was not exposed by this specific flaw. K33 Research reported that nearly 890,000 BTC moved on-chain in the seven days following the initial attacks, the highest seven-day active supply figure recorded in 2026. OKX chief compliance officer Jonathan Brockmeier said the exchange has seen record inflows since the Coldcard attacks began, describing the shift as "the flip side of FTX." The incident has triggered calls for hardware wallet certification reform, with existing frameworks checking physical security and cryptographic library correctness but not systematically verifying that production firmware actually calls approved entropy sources during wallet creation.
