1,596 bitcoin. 7,300 addresses. One firmware build error. The first discovery put losses at $38 million. By Saturday, the figure had climbed to $88.6 million. Current estimates exceed $100 million. A suspected fourth wave would bring the total to 2,055 bitcoin — roughly $130 million. This is not a phishing campaign. It is not a compromised exchange hot wallet. It is a hardware security device producing predictable private keys for two years and four months.
The fix landed on July 31. It cannot repair the damage. Firmware patches do not regenerate seeds. Once entropy is compromised, the wallet's foundation is permanently broken. The ledger never lies, only the narrative does.
Coldcard occupies a specific niche in bitcoin infrastructure. It is the wallet for users who distrust complexity. No touchscreen. No Bluetooth. No wireless connectivity. Pure isolation. Its firmware is open source. Its design philosophy is explicitly minimalist. For a certain class of bitcoin holder — the paranoid, the long-term, the technically literate — Coldcard has been the default answer to the question of self-custody.
This is precisely why the incident matters. The user base consists of the most security-conscious cohort in bitcoin. These are individuals who perform their own key management reviews. Their failure mode is not carelessness. It is overconfidence in a hardware promise.
The vulnerability chain is documented by Galaxy Research. In March 2021, a build error entered the Coldcard firmware. A configuration setting instructed the device to skip its hardware random number generator — the TRNG. The companion library responsible for validating this configuration checked whether the setting existed. It did not check whether the setting was enabled. The validation was structural, not functional.
With the TRNG out of the circuit, key generation fell back to a software alternative. The seed material was derived from the chip's serial number and timer registers. Neither input is secret. Both are knowable. Private keys generated in this state occupy a predictable namespace. They are not random. They are enumerable.
The attack window opens in March 2021 and remains open until the patch release on July 31. Any wallet initialized or restored during that period carries the contamination.
Let me break down the mechanism with the discipline it deserves. The TRNG is the first principle of any hardware wallet's security architecture. The device exists to provide a physically isolated environment for key generation and transaction signing. When that environment silently downgrades its entropy source, the product stops being what the packaging claims.
This is a textbook fail-open error. In secure systems, the failure mode must be fail-secure. If entropy is unavailable, the device must refuse to operate. It must not produce keys at all. Instead, this firmware produced keys that an attacker could reconstruct. The chip serial number is printed on device packaging in some variants. Timer register values are substantially knowable. Combining both does not produce cryptographic security. It produces the illusion of it.
Now step back and look at the on-chain footprint. Galaxy Research has identified three principal attack waves and fourteen smaller incidents. The total count is 1,596 bitcoin pulled from approximately 7,300 addresses. The loss progression is instructive: $38 million when first discovered, $88.6 million within four days, over $100 million shortly after. A fifth day changed the picture again. This is not the signature of a single lucky exploit. This is the signature of a systematic enumeration.
The attacker is not randomly selecting addresses. They are working through a predictable key space, harvesting high-balance wallets first, and batching lower-yield addresses in secondary waves. This requires automated processes and patient monitoring.
Two data points deserve particular scrutiny. First, only 73 victims have contacted Galaxy Research out of roughly 7,300 affected addresses. That is approximately one percent. The remaining ninety-nine percent is what I would call the silent-victim problem. Many affected users have no idea their wallet is contaminated. Their funds may still be present today. They may be harvested tomorrow. Or the attacker may be waiting for those addresses to accumulate more bitcoin before striking. The attacker controls the timeline. The victims do not know the game has started.
Silence is the loudest warning sign in the code.
Second, ninety percent of the stolen bitcoin has not moved since the thefts. On the surface, this reads as a positive data point. The attacker has not cashed out. The market has not absorbed liquidated supply. But this is not equilibrium. It is latency. The funds remain in the attacker's control. Whether they flow into a mixer, reach an exchange, or remain dormant for years is not a question of what is possible. It is a question of what the attacker calculates as profitable.
There is an alternative interpretation, and I want to be precise about it. The attacker's addresses have been distributed to federal law enforcement, cryptocurrency exchanges, and blockchain intelligence firms. Cashing out is no longer a simple operation. It requires avoiding exchange freezes and evading on-chain tracking. The cost of liquidation may now exceed the value of the funds. This could explain the dormancy. It is not charity. It is mathematics.
I have spent my career tracing asset flows in events like this: the SushiSwap migration of 2020, the Terra/Luna collapse, the NFT rarity distortions of 2021. What separates this event is the timing. The funds are stolen from a device whose entire value proposition is cold storage. No exploit infrastructure. No social engineering. No insider access. The attacker simply enumerated.
The patch released on July 31 does not regenerate seeds. It stops new wallets from inheriting the vulnerability. It does nothing for the compromised ones. If a Coldcard user generated or restored a wallet after March 2021 and believes it is secure, the rational response is to migrate immediately. Not next week. Not after the next announcement. Now.
The scale requires calibration. In the history of crypto security events, the largest thefts belong to bridge exploits and exchange compromises. Ronin Bridge lost roughly $600 million. This event is smaller in raw value. But it ranks high in a different category: hardware wallet attacks. The point of hardware wallets is physical security. A compromise of the firmware's entropy source is an attack on the core assumption of the industry.
This is not the first TRNG-related failure in the hardware category. But the scale here is different. We are not observing a theoretical proof of concept. We are observing a live, ongoing extraction with confirmed victims. The pattern has been demonstrated in production. The attacker has had months of advance practice against high-value targets.
The affected addresses may not all have been drained. Some wallets were generated in the vulnerable window and never used. They contain no balance today but will be watched by the attacker indefinitely. The threat is not time-bound. It persists until the seed is discarded.
The uncomfortable truth is that this attack exploits the design philosophy of Coldcard. The product's brand is minimalism. Fewer features. Fewer attack surfaces. Less complexity. Users chose it precisely because of that reduction. And yet the entropy downgrade happened because a validation library trusted the existence of a configuration setting rather than verifying its operational state.
That is not the consequence of too many features. It is the consequence of insufficient scrutiny at the one layer that matters. The firmware is open source. The code is auditable. And still, a build error from March 2021 survived for two years. The community's own assumption — that transparency equals security — was the vulnerability. Open source reduces the cost of review. It does not guarantee the review occurs.
The industry lesson is not "hardware wallets are unsafe." That conclusion is too broad and too lazy. This is a firmware logic failure, not a physical side-channel compromise. It is not the same vulnerability class as an RF leak or a secure-element extraction. The distinction does not reduce the losses. It changes the corrective action. The correction is a mandatory TRNG self-verification step in the wallet boot sequence. Every wallet should verify, on every power-up, that the entropy source is operational and genuine. That validation should be enforced by the secure element or the boot ROM, not by a companion library checking for a flag.
This industry needs a precedent. In my 2017 ICO diligence work, I found that three of five reviewed smart contracts had reentrancy vulnerabilities. The pattern was always the same: an assumption about external calls that was never validated at runtime. The Coldcard vulnerability belongs to that family. The assumption lives in a library. The validation never occurs. The system fails open.
Hype is a liability; data is the only asset. The data in this case shows a hardware wallet industry that has exported its safety proposition as a black box. The Coldcard incident cracks that box open. Some users will conclude that self-custody is not worth the effort. They will return to exchanges and custodians. That outcome benefits the entities they are trying to avoid. The correct response is not abandoning hardware wallets. It is demanding higher standards from them.
I will not predict bitcoin's price. That is not my function. What I can do is read the ledger. The ledger says the entropy source was bypassed. It says a library checked the wrong thing. It says funds moved from predictable addresses. It says ninety percent of the stolen coins are, for now, still and quiet. But quiet is not safe.
If you hold a Coldcard initialized after March 2021, assume your seed is in the vulnerable namespace. Check the known affected address list. If your address appears, migrate. If it does not appear, the risk persists because enumeration is ongoing. The fix is not a patch. It is the discard of the old seed and the generation of a new one on verified hardware. Nothing less is sufficient.
Rarity is a construct; supply is a fact. The supply of predictable seeds is a fact. The count is approximately 7,300 and rising. Trust the hash, question the headline. The next update is not a security measure. It is a reminder that security is an active process, not a product specification.