Digital Asset
Intelligence
Security Incident

Coldcard Firmware Vulnerability: $100.00M Reported Loss

·Historical incident record

Incident Overview

Coldcard hardware wallets (by Coinkite) suffered from a firmware bug (since March 2021 on certain versions) that generated seeds with insufficient entropy (~40 bits on Mk3, ~72 bits on newer models vs. the intended 128 bits). Attackers offline brute-forced predictable private keys and drained numerous single-signature Bitcoin addresses across multiple waves without ever accessing the devices, with cumulative losses exceeding $100 million and the incident ongoing.

Sources & References

Original incident referencehttps://x.com/glxyresearch/status/2084411904924045370 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Target

    MOKE

    Attack methodSmart Contract Vulnerability
    Reported loss$ 907700
  2. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 9,600
  3. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 10,000
  4. Incident date
    Target

    $TENDRIL

    Attack methodSmart Contract Vulnerability
    Reported loss$ 555000
  5. Incident date
    Attack methodUnknown
    Reported lossNot disclosed