Coldcard Attack Hits 1,159 BTC: Why Bitcoin's 'Safest' Wallet Is Now a Live Market Risk

Coldcard thefts are still moving, keeping Bitcoin custody risk in the market

The stolen-BTC total is still a live overhang

The suspected Coldcard-related thefts have climbed to 1,158.81 BTC, held in attacker addresses that remain under monitoring. This is not a closed incident report; it is still an active Bitcoin-flow concern.

The biggest jump came on July 30, when the attacker swept 1,082.65 BTC from 1,196 Bitcoin addresses in 41 minutes. At the time, that was about $70.2 million. The market risk is not just the headline loss, but the possibility that a large pile of coins could move quickly.

Galaxy says a third wave is changing the pattern

Galaxy says a third wave of sweeps has emerged, with the operator now targeting smaller balances and changing how funds are collected onchain. That matters for sentiment because it suggests the operation is still active rather than winding down.

For Bitcoin investors, that turns a security story into a market story. There are visible coins in monitored attacker wallets, and ongoing chain activity can keep the sell-supply debate alive whenever sentiment is fragile.

The urgency is practical, not theoretical. Owners are still being told to move your coins now if they used affected Coldcard key generation. Until the activity stops, this remains an open risk to sentiment.

The problem sits in Coldcard's seed generation, not in Bitcoin

This is not a Bitcoin protocol failure. The issue sits at the wallet layer, in how some Coldcard devices generated seeds before the fix.

What actually broke

Coldcard's problem was a March 2021 firmware integration error that routed seed generation to a deterministic software pseudorandom number generator instead of the STM32 hardware RNG. In simple terms, affected devices did not produce enough true randomness when those seeds were created.

That changes the attack surface. Instead of guessing one seed out of 2¹²⁸, an attacker could narrow the search. Block says an attacker could reproduce candidate output streams offline using device UID, timer state, and prior RNG-call history, then test candidate seeds against public blockchain data.

Why the firmware fix does not solve old seeds

Coinkite shipped emergency firmware on July 31 for every affected model and release track. That patch stops new bad seeds from being generated the same way, but it does nothing for seeds already created on vulnerable firmware.

Holders often miss that point: updating the firmware does not change or repair an existing seed. If the original seed was created on affected firmware, the weakness travels with it. Restoring that seed to patched firmware or another wallet carries the same exposure forward.

The 50-dice-roll exception is the key exception

There is one clear exception. If a seed was created with at least 50 fair, independent, private dice rolls, Coinkite does not consider that seed at risk from the RNG flaw alone.

That makes the user action simple and important: Fewer than 50 rolls, or you do not remember should be treated as exposed, and those funds should be migrated. The fix is a new seed on patched firmware, not a firmware update by itself.

What matters now is migration speed, not patch headlines

The next few days matter because the fix is only as good as the migration. Coldcard's notice is explicit: updating the firmware does not change or repair an existing seed. So the real signal is not that a patch exists. The signal is whether affected holders install the fix, create a new seed, and move funds.

If migration is fast, the incident is more likely to stay contained. If it drags, traders will keep pricing the risk that more coins become movable.

What to watch

• Whether the total of monitored, thief-held BTC stays steady or rises.
• Whether sweeps keep spreading to smaller balances.
• Whether affected holders actually migrate instead of merely updating firmware.
• Whether stolen coins remain idle or finally move.

What would weaken the bearish read

This is best treated as a custody-fragility event, not an argument against Bitcoin itself. The bearish case gets stronger only if activity keeps shifting, vulnerable wallets stay quiet for the wrong reasons, and holders delay migration. Over the next days and weeks, price is more likely to follow migration discipline and attacker behavior than ideology.