Coldcard Issues Urgent Alert as Active Firmware Exploit Drains $114M in Bitcoin

Coldcard has issued an urgent warning: certain hardware wallet models remain vulnerable to an exploit that has already drained up to $114 million in bitcoin, with the threat still live and user action urgently required.

What Happened

The hardware wallet manufacturer Coldcard, operated by Coinkite, disclosed this week that a firmware vulnerability has enabled attackers to steal substantial bitcoin holdings from self-custodied wallets. The exploit, which targets models including Mk3 (firmware 4.0.1 or later), Mk4, Mk5, and Q units running outdated firmware, has persisted unnoticed since 2021. The flaw specifically allows adversaries to guess weakly randomized seed phrases—particularly if setup entropy was inadequate—enabling unauthorized fund access without secondary approvals. Losses have escalated, with the cumulative impact now reaching approximately $114 million according to Galaxy Research’s updated tally, as highlighted by a recent CoinDesk report. Notably, wallets set up using Coldcard’s dice-roll feature remain unaffected due to superior entropy inputs.

The exploit came into sharp focus as Coldcard issued a direct advisory to its user base, emphasizing that action is not merely precautionary but required immediately. Users with affected wallets must upgrade their firmware, generate new secure seed keys, and migrate their bitcoin to new wallets to protect their assets. Alerts specifically encourage users to reach out to less-active community members, given the heightened exposure of those not regularly checking updates or device advisories. The exploit remains in progress, with additional losses recorded during a fresh wave of attacks.

Why It Matters

The breach represents one of the largest confirmed hardware wallet exploits to date, raising questions about the resilience of self-custody security models. While the decentralized nature of self-custody is often championed in the crypto community, this incident underscores the ongoing necessity for both robust technical processes—such as secure random number generation—and proactive user behavior. Many affected users may not monitor firmware updates or security advisories, extending the exploit’s window of opportunity. The fact that dice-based seed setups remain safe further validates the principle that security often hinges on the weakest link, which may be protocol-level, device-level, or user-specific.

Historically, firmware and entropy bugs have posed significant risk for hardware wallets, despite their reputation for enhanced security over hot wallets or custodial solutions. This episode exposes a broader challenge: device supply chains, patch distribution, and security education can all lag behind fast-moving threats, especially when the path to remediation requires active user intervention. As such, analysts generally monitor not only patch availability but also user update adoption rates, since exploits frequently target the inertia presented by less-engaged holders. Ultimately, hardware is only as secure as its upkeep and the entropy of its seed creation process.

Key Takeaways

• Active firmware exploit has led to approximately $114M in BTC losses from Coldcard wallets.
• Only wallets using dice-roll setup are considered secure from this vulnerability.
• Timely firmware upgrades and seed regeneration are critical for all affected devices.
• Delayed user action extends the window of ongoing attacks and potential losses.

What’s Next

The market will be watching user response rates and the propagation of this advisory across the bitcoin community—particularly among holders who may not closely follow technical communications. Security researchers will likely analyze whether hardware wallet vendors can improve real-time update mechanisms and entropy best practices. Moving forward, the focus will be on rapid patch adoption, minimization of single-point self-custody vulnerabilities, and whether industry-wide standards for secure seed generation—such as physical randomness—become mainstream. Further waves of losses may occur until the majority of exposed funds are migrated out of at-risk wallets.

Related Stories

Coldcard Hardware Wallet Exploit Spurs Bitcoin Holders to Shift Funds to Exchanges Coldcard Wallet Exploit Triggers Record Small-Scale BTC Transfers Ostium Exploit Drains $18M in USDC as Oracle Attackers Target DeFi Infrastructure