$70M in Bitcoin Vanished in 41 Minutes: Coldcard's Hidden Weakness Exposed

The Coldcard drain happened faster than the warning

About 1,082.65 BTC worth roughly $70 million was drained from 1,196 addresses in about 41 minutes. The speed points to an automated sweep rather than a scattered set of compromises.

Galaxy Research said the attacker did not need to breach the devices directly. A weak seed generation flaw allowed likely private keys to be recreated offline, so funds could be swept without ever touching the hardware itself. For users on affected setups, that turns a recovery phrase into the weak link.

Coinkite publicly warned users almost 30 hours after the drain window ended. That delay left a window in which affected holders may have remained exposed before the issue was widely communicated.

Galaxy Research used fee and timing signals to map the sweep

High fee and batched broadcasting stood out

Galaxy Research said the key discriminator was the transaction fee. Bitcoin sees thousands of consolidation transactions every day, so fan-in alone is a weak signal. In this case, the event was flagged at 30 sat/vB transaction fee, which helped narrow the set of suspicious transfers.

Timing added another clue. Galaxy Research said the full event spanned six blocks and 41 minutes, with three intervening blocks showing no sweep activity. That pattern is more consistent with batched broadcasting than with a steady, organic stream of transactions.

Onchain fingerprints can help survivors screen exposure

Galaxy Research also said the initial attack is identifiable onchain, while noting that its analysis may not be complete. That makes the finding practically useful: users and analysts can look for similar fee behavior, timing patterns, and destination clustering instead of relying only on offchain notices.

The analysis was also anchored by real-world confirmation. Galaxy Research's thread included a victim report of funds moving from affected outputs into the same investigation addresses, reinforcing the transaction path researchers were tracking.

What investors need to price now

The immediate question is no longer just how much was taken. It is whether vulnerable wallets are still being matched offline and whether more funds remain exposed. Additional vulnerable wallets could still be at risk, which keeps this from being a closed, one-day headline.

Why the market reaction could stay contained

This was a wallet-generation issue, not an exchange breach or a Bitcoin protocol failure. The initial attack is identifiable onchain, so analysts can trace the pattern rather than treat the event as a systemic shock to the entire network.

What would change the read-through

Watch for two signals:

• Fresh outflows from still-vulnerable addresses, which would suggest the sweep is continuing.
• Calm in migrated supply, which would support the view that most exposure has already been cleaned up.

If stolen funds remain dormant and users keep moving capital away from affected wallets, the market can absorb the hit as a contained security incident. If new sweeps keep appearing, the event will stay relevant as an active flow risk.