Coldcard Firmware Exploit Leads to Theft of 2,100 BTC, Nearly $130M Loss

According to a report from ChainCatcher, a firmware vulnerability in Coldcard hardware wallets has been exploited, leading to the theft of roughly 2,100 Bitcoin and causing losses that approach $130 million. Data from the blockchain indicates that in the days around the exploit, wallets associated with long-term holders sent out approximately 233,000 Bitcoin, worth around $15 billion. Nick Neuman, the chief executive officer of Casa, stated that a portion of these outgoing transfers came from Coldcard users who were moving their holdings into multisignature wallets. He also noted that users of Ledger and Trezor devices adopted similar measures after the security incident. During the same period, close to 22,000 Bitcoin were shifted into exchange platforms. In response, Coinkite, the company behind the Coldcard product line, has instructed customers who generated their mnemonic phrases using firmware versions 4.1 through 4.1.9 to regard their wallets as compromised and to migrate to new seed phrases without delay. These firmware versions correspond to the timeframe spanning March 2021 to July 2026.