The data shows an attack still running through the Bitcoin address space. At the time of the latest report, 15 separate attackers were draining vulnerable Coldcard wallets. The count is a lower bound. It will be 16 or 20 or 100 by the time this paragraph is indexed. Galaxy Research has collected 73 victim reports. The victim floor is 73; the real number is likely in the thousands. The exposed wallet population is at least 7,300. The realized loss is over $130 million in Bitcoin. The first thefts happened hours before Coinkite issued a public warning. That is not an accident. That is a predator recognizing a fenced pasture.
This is not a hack in the Hollywood sense. No exchange API was crushed. No private key was extracted by a zero-day in the ledger. The algorithm broke, so the money evaporated. Liquidities are trapped in code, not in trust. When the code breaks, the liquidity is not negotiated away. It is simply gone.
Context
Coldcard is not a disposable wallet. It was the device recommended to users who wanted to prove they controlled their keys. It had a reputation for being the paranoid choice. It was the thing you bought after you stopped trusting exchanges. It had a secure element, a small screen, and an attitude. That reputation made the failure worse.
The root cause is not a key extraction bug. It is not a phishing attack. It is entropy generation. A Bitcoin private key is a random number. The entire security model depends on the randomness source. If the source is a true random number generator, the key is selected from a space of 2^256 possibilities. If the source is a software pseudo-random number generator with weak seeding, the key is selected from a much smaller set. On affected Coldcard firmware, seed generation was routed to MicroPython's software PRNG. That is not a true random source. That is a deterministic algorithm that depends on the quality of its initial seed. In affected models, the effective entropy was approximately 40 bits on Mk2 and Mk3, and 72 bits on Mk4. The acceptable minimum for a long-term Bitcoin key is 128 bits. The gap is not a rounding error.
I have spent the last 12 years reading smart contracts the way other people read headlines. In August 2020, I found an integer overflow in Compound's governance module. The protocol looked pristine from the outside. The flaw sat in a path nobody wanted to read. I submitted the report, received a bounty, and learned a permanent rule: audit the logic before you trust the label. The same rule applies to hardware. Labels are marketing. Logic is math. This Coldcard event is the same rule operating at a different layer of the stack.
The Math
Let me file this as a bug report. The affected devices are not an obscure test batch. They are the mainline Coldcard product line. The vulnerable seed generation was present in production hardware that had been sold as a secure self-custody solution. The attack surface is the Bitcoin blockchain itself. Every address is a hash of a public key. Every address that has spent even once has its public key exposed in a transaction. The attacker does not need to break into a device. The attacker only needs to enumerate the small key space and compare the results with the public data already sitting on the ledger.
The search looks like this:
for candidate in range(1, 2*40): point = candidate G if hash160(point) == target_address: return candidate
That is not an exotic exploit. That is a textbook enumeration attack. For 40-bit entropy, the search space is around one trillion candidates. That is a weekend project for a motivated analyst. For 72-bit entropy, the search space is larger, but it is still an island in the 2^256 universe. Attackers are not required to attack all wallets in one pass. They scan for the weakest high-value addresses, drain them, and move to the next batch. The barrier to entry is a laptop, a blockchain indexer, and a basic understanding of elliptic curve multiplication.
This is why the attacker count is rising. Once the technique is known, anyone with scripting ability can join. The first attackers were not necessarily more sophisticated than the latecomers. They were simply earlier. The public chain gives the latecomers the same inventory. The only difference is that the easy addresses disappear first.
The Timeline Is Not Reassuring
The first thefts were executed before Coinkite told the public anything. That timing matters. It means the attacker had enough technical detail to identify and execute a specific class of weak keys before the vendor could issue a warning. The disclosure simply opened the market to the rest of the pack. Now every scanner on the internet knows where to look.
Coinkite's response was fast by corporate standards. The co-founder apologized publicly. A hotfix was pushed to all affected models and release trains. The company repeated that the threat is still active. That is the correct operational behavior. But it does not fix the existing seeds. The company was explicit: updating firmware cannot repair seeds generated by vulnerable firmware. The only remedy is to generate a new seed on hardware that uses a verified true random source and move the Bitcoin.
This is the detail most users will miss. They will update the firmware, see the new version number, and assume the wallet is safe. It is not. The firmware update protects future seeds. It does not re-roll the past. The old seed is still mathematically trapped in a tiny search space. Updating the software does not change the math.
The Hidden Data
The hidden data is bigger than the report. The known floor is at least 7,300 exposed wallets and 73 reported victims. But 73 is a response rate, not a population. Many long-term holders will not check their wallets today. They will check when they need to sell. By then, the attacker has already spent the coins. The silent wallets are the real inventory. Some of them are owned by people who will not discover the loss for weeks or months.
I know this pattern from the 2022 Terra collapse. When the stablecoin depegged, the first reaction was not data collection. It was denial. People waited for a recovery that never came. I survived that event because I had a rule written before the stress existed: if the stablecoin depegs, liquidate 40% into Bitcoin within 48 hours. The rule did not care about my feelings. It was a line of code. The people who survived were the ones who had a rule for the moment before the market demanded it.
The same principle applies here. The rule for Coldcard users is simple: if you generated a seed on affected firmware, do not update the firmware and pray. Move the funds. Not after an official report. Not after the attacker count catches your attention. Now. Fear is a bad indicator. Data is a leader. The data says the key space is weak.
Market Mechanics
Do not confuse market impact with narrative impact. $130 million is a serious number, but it is small relative to Bitcoin's daily traded volume. The immediate effect on the Bitcoin price will likely be muted. However, this is a sideways market. Chop is for positioning. The real impact is not in the candle; it is in the custody flows.
The stolen coins are still mostly untouched. About 90% of the stolen Bitcoin has not moved. That is not a sign that the attack is over. It is a sign that the attacker is patient. A lazy attacker spends today. A smart attacker spends when the market can absorb the sell without moving the price against him. This creates a latent overhang that the market is not pricing. Red candles do not negotiate with hope.
There is also a migration effect. Some Coldcard users will move to other hardware wallets. Some will move back to exchange custody. That shift is not neutral. Moving from a hardware wallet to an exchange is not a safety upgrade. It is a change of trust assumptions. A centralized exchange is a single point of failure with legal risk, hack risk, and human error. The goal is not to choose the lesser brand. The goal is to verify the actual entropy source before storing value.
The Contrarian Angle
The uncomfortable conclusion is not that Coldcard is uniquely guilty. The uncomfortable conclusion is that the entire hardware wallet industry is selling a trust label, not a verified proof. Coldcard was considered the gold standard for paranoia. The same industry will now point to other vendors and say, we are safer. That is a narrative, not an audit. The absence of a public exploit is not a security feature. It is simply the absence of public information.
I have no position in Coldcard, Ledger, or Trezor. My only position is in verifiable evidence. If a hardware vendor cannot show me a documented audit trail for where its random bytes come from, I treat the device as unproven. A hardware wallet without a hardware randomness source is just a keyboard with a screen. The secure element is irrelevant if the key generation path does not use it.
This event should also end the assumption that firmware updates are a cure. Firmware updates are patches. Patches stop new infections. They do not heal old wounds. The user who updates today is still exposed if the seed was generated yesterday. The industry needs to be honest about the difference between remediation and migration. Remediation is for the software. Migration is for the user.
In 2023, I wrote a standardized Python framework to monitor Solana RPC nodes. It reduced transaction failure rates by 15% for my trading bots. The lesson was not the code. It was the monitoring discipline. If Coinkite had monitored entropy quality the way my nodes monitor latency, it would have caught the collapse before the attacker count reached 15. The absence of that monitoring is not a minor oversight. It is a governance failure.
The Regulatory Layer
Law enforcement is investigating. That is a useful backstop, but it is not protection. If the stolen coins move through a regulated exchange, the AML triggers may produce a chain of custody. If they move through a mixer or an over-the-counter desk, the trail is much harder to follow. The industry cannot wait for arrests. The protection has to happen before the key is generated.
The event will likely push regulators to ask harder questions about hardware wallet security standards. They should ask about random number generation, independent audits, and vulnerability disclosure timelines. They should also ask why no independent audit of the affected firmware was published before the product was sold as safe. Those questions are overdue. Hardware wallets are not jewelry. They are devices that hold the keys to a bearer asset. The standard of proof needs to be higher than a marketing page.
The Takeaway
The action plan is not complicated. If you are not certain that your Coldcard seed was generated after the hotfix, assume it was not. Move the funds to a new wallet with a fresh seed. Use a device from a vendor that publishes its entropy source and audit chain. Do not spend from the old wallet first. Spending exposes the public key and makes the brute-force search even cheaper. Move everything in one transaction. Then verify that the old address is empty and mark it as radioactive.
This is the same logic as a stop-loss. It is not an opinion. It is a rule created before the market moved. The market does not care about your intentions. The blockchain does not care about your hope. Efficiency is the only honest validator. The algorithm broke, so the money evaporated. Audit the logic before you trust the label.
The next time you see a device described as secure, ask one question: where do the random bytes come from? If the vendor cannot answer with a documented, auditable, reproducible process, the device is not secure. It is merely a box. The Coldcard incident is not the end of self-custody. It is the beginning of the entropy audit era. The question is not whether the attackers will move the remaining coins. It is whether the industry will treat this as a reason to standardize randomness verification before the next label fails. What else is asleep in a device that was supposed to be the last line of defense?