Coldcard Cold Storage Just Lost $1.6M-and a $70M Bitcoin Sweep Exposed the Real Risk

Jonathan Goodman's Coldcard loss kept the focus on key-origin risk

Jonathan Goodman said his Coldcard lived in a safety deposit box and was never connected to the internet, yet he still lost 18.25245043 BTC in seven minutes between 9:36 pm and 9:43 pm on July 29-roughly $1.6 million. His account shows the funds were drained from wallets generated on the device, which is why the case has become more about trust in self-custody than about obvious user error.

Galaxy Research tied a massive July 30 sweep to Coldcard firmware

The bigger story came the next day. On July 30, Galaxy Research traced a 1,082.65 BTC sweep from 1,196 Bitcoin addresses in 41 minutes, worth about $70.2 million at the time, and linked it to a Coldcard firmware flaw.

The underlying issue matters. A March 2021 firmware bug routed seed generation to a deterministic software PRNG instead of the STM32 hardware RNG. In practice, that means an attacker who can determine or narrow down the device UID, timer state, and prior RNG call history may be able to reproduce candidate seed streams offline, then test those candidates against public blockchain data.

Coinkite shipped emergency firmware on July 31 for every affected model and release track. But that update does not repair an already-exposed seed. Coinkite has told affected owners to generate a new seed on patched firmware and move their coins. Restoring an old seed on updated firmware-or on another wallet-carries the weakness forward with it.