Coldcard hack: Up to 1,816 BTC lost in software breach

The Coldcard hack resulted in losses of 1,432–1,816 BTC due to a software flaw in private key generation. Exact losses are unclear and depend on public reports.

The Coldcard hardware wallet hack led to significant Bitcoin losses, though the total amount remains uncertain. Estimates differ: CryptoQuant reports 1,432 BTC stolen, while Galaxy Research and TRM Labs suggest up to 1,816 BTC, with Galaxy’s high-confidence minimum at 1,730 BTC. Attackers exploited a vulnerability in software-based private key generation, introduced in a March 2021 firmware update. This flaw enabled offline guessing of recovery seeds, allowing funds to be drained from over 5,200 addresses in multiple waves, without physical access to devices. Loss estimates rely on public victim reports and blockchain analysis, making it difficult to determine the exact figure. The incident highlights challenges in self-custody security and the limitations of blockchain forensics in quantifying losses from non-custodial wallet breaches.