A fourth wave of coordinated thefts hit Coldcard hardware wallet users Monday, with 218 transactions moving 388.9 Bitcoin across 462 potential victim addresses in a matter of hours, per Galaxy research head Alex Thorn. The attack rate hit 13.8 sweeps per block, roughly 45 times the baseline observed before the vulnerability was disclosed. The activity follows the revelation of a firmware flaw that generated wallet seeds with reduced entropy, compromising an estimated 1,100 wallets and resulting in $90 million in Bitcoin stolen to date. Most of the latest transfers sent funds to fresh destination addresses rather than a central collection wallet, and some have already moved to second-hop addresses, suggesting the attacker is preparing to obscure the trail.
The Coldcard exploit is not a BTC price driver — this is targeted theft, not systematic selling — but it marks a rare instance of hardware wallet firmware compromise at scale. The affected devices are a minority of the installed base, and the vulnerability has been disclosed, meaning users can now upgrade and migrate. The immediate risk is reputational: hardware wallets are the gold standard for self-custody, and a firmware flaw that leaked seed entropy undermines that assurance. The exploit does not create exchange-bound sell pressure — stolen coins typically move through mixers and off-exchange settlement — but it does highlight that even air-gapped solutions carry implementation risk.
For traders, this is a reminder that security events in self-custody infrastructure can shift institutional adoption timelines without moving spot price. The BTC market is pricing macro and ETF flows, not wallet-level exploits. Funding remains positive at 1.0 basis points per eight hours, 67 percent above the 30-day average of 0.6bp, and Fear & Greed sits at 28, effectively flat against the 30-day average of 26. There is no directional signal here. The Coldcard incident is contained to a specific hardware vendor and does not alter the broader custody landscape.
The one thing to watch is whether other hardware wallet vendors disclose similar seed-generation flaws in the coming weeks. If this becomes a class-wide issue rather than a Coldcard-specific bug, the narrative shifts from isolated vendor risk to systemic self-custody risk, and that could accelerate structural shifts in custody approaches. Thorn noted that some victim transactions remain unconfirmed in the mempool, meaning affected users who still control their keys can broadcast a higher-fee conflicting transaction to recover funds before the attacker's sweep confirms. That window is narrow and requires users to act within minutes of detection, but it represents a technical countermeasure that may save a portion of the remaining at-risk balances.
Source: CoinTelegraph