Coldcard Break-in Hits 1,360 BTC: The 10% Laundering Pitch Says the Theft Is Not Over

Coldcard losses have climbed toward $89 million

The affected pool is now around 1,367.05 BTC, or roughly $88.6 million, after Galaxy Research flagged a third wave of sweeps tied to weak Coldcard-generated keys. That follows the first identified drain, which removed 1,082.65 BTC from 1,196 addresses in 41 minutes and was worth about $70.2 million at the time. The core question is no longer just how much was taken, but how much exposure still remains.

The situation has also drawn fresh attention because the main consolidation address sitting on roughly 562 BTC from the exploit received a 562 BTC laundering offer for a 10% cut. Importantly, the stolen coins remain completely unmoved as of the latest reporting, so the offer signals that exit capacity may be getting marketed rather than proves that fresh selling is imminent.

The vulnerability weakened seed generation, not Bitcoin itself

A firmware mistake created low-entropy seeds

This was not a break in Bitcoin's cryptography. It was a March 2021 firmware integration error that sent seed generation to a software PRNG instead of the device's hardware RNG. That fallback was initialized from values such as the chip's unique ID and timer registers and collected no fresh entropy after initialization.

In practical terms, that made affected seeds easier to narrow down offline. If an attacker can estimate the device UID, timer state, and prior RNG calls, they can reproduce candidate seed streams and test them against public blockchain data.

Who is actually at risk

Coinkite estimates effective entropy at roughly 40 bits on the Mk3 and about 72 bits on the Mk4, Mk5 and Q, compared with 128 bits for a standard 12-word BIP-39 seed. That is why the exposure is tied to when the seed was created, not simply to whether the device is currently owned.

Coinkite shipped emergency firmware on July 31, but that update does not repair a seed already generated through the weak path. Affected setups include Mk2 and Mk3 running versions 4.0.0 through 4.1.9, Mk4 and Mk5 before 5.6.0, and Q before 1.5.0. The practical fix for exposed users is to generate a new seed on patched firmware and move funds there.

Moving funds still depends on a new seed

Restoring a weakened old seed to updated firmware or to another wallet carries the problem forward. The danger is not just outdated software; it is an old seed that can still live in cold storage, on a new device, or inside another application.

The laundering pitch matters because the coins are still dormant

What the on-chain offer actually shows

A dust transaction carried an OP_RETURN message offering to launder 562 BTC for a 10% cut, with a total cost of about $1.30 to deliver the pitch. That is cheap outreach against a very large target.

Just as important, the stolen bitcoin remains completely unmoved as of the reporting window. So the message is best read as evidence that exit capacity is being advertised, not as proof that a large sale is about to hit the market. After the initial drain of 1,082.65 BTC and the subsequent third wave of sweeps tied to weak Coldcard-generated keys, the supply overhang is still very much in view.

What would turn attention into price pressure

The key variable is execution, not narrative. Price would be more likely to feel pressure if: - the dormant coins start moving, - new sweep activity expands the exposed balance, or - exchange or custody messaging intensifies concern around affected self-custody setups.

If the stolen funds remain completely unmoved and no new distribution signal appears, the threat stays closer to headline risk than to realized sell pressure.

This episode is best understood as a self-custody execution failure rather than a flaw in Bitcoin itself. For now, the main watchpoints are Coinkite's guidance, any exchange notices, and whether dormant stolen coins finally start to move.