Coldcard Hack Passes $130 Million - and Coinkite Still Won't Size the Full Damage

Known losses are already large, but total exposure remains open

Losses are already estimated at around $130 million, and more BTC could still be drained. That open-ended risk is what keeps pressure on market sentiment.

The scale is already large enough to matter. Galaxy Research says the attack has hit more than 5,200 individual addresses, with hackers having moved approximately 1,816 Bitcoin worth nearly $116 million across four waves of thefts. Once a headline number gets this big, market participants usually focus on what can be verified and observed now.

The pace has been the sharpest warning sign. On July 30, attackers drained 1,196 Bitcoin addresses in 41 minutes, taking 1,082.65 BTC worth about $70.2 million. That speed suggests an active liquidation phase rather than a slow leak.

Coinkite has not filled the biggest accounting gap. The company shipped emergency firmware for every affected model and release track on July 31 and warned users to move funds, but it still has not provided a clean estimate of total exposure. Without that number, the market has to assume more coins could still be at risk.

That uncertainty splits the debate. If migration and thefts slow, the sell pressure may eventually exhaust itself. If not, traders still lack a clear ceiling on potential losses.

Why the Coldcard flaw makes valuation harder

The vulnerability turns a cold-storage problem into an entropy problem

Coldcard was supposed to keep seeds offline, inside the physical device. But a March 2021 firmware integration error routed seed generation to a software pseudorandom number generator instead of the device's hardware RNG. That shifts the risk from a targeted break-in to a weaker randomness problem.

The affected scope is not theoretical. Coinkite says Mk3 devices are affected by the older firmware window. On affected Mk4, Q and Mk5 devices, the exposed seeds appear to have about 72 bits of entropy rather than the expected 128 bits. That does not mean every key is easy to crack, but it does mean these wallets cannot be treated like ordinary cold storage while the exposure is still unfolding.

Why traders struggle to price the fallout

A known theft can be tracked. A latent exposure problem is much harder to model.

First, the trust issue spreads beyond one product. Users are no longer asking only whether Coldcard is currently under attack; they are questioning whether the wallet still meets the unpredictability implied by offline storage.

Second, migration is conditional, not universal. Coinkite says funds are at risk if the seed was created without at least 50 independent, private dice rolls and without a strong, unique BIP-39 passphrase. That likely creates uneven user behavior: some holders move quickly, some hesitate, and some may wrongly assume they are fine.

Third, the brand damage reaches beyond the immediate losses. Galaxy says at least a dozen different hackers are involved, which widens the immediate threat and reinforces the message that supposedly secure offline wallets can still be vulnerable on a large scale.

The bull case and bear case in plain terms

The cleaner bull case is straightforward: fixed firmware is now available, and if most users migrate to new seeds on patched firmware, the attack surface can shrink quickly.

The bear case is that updating firmware does not repair an existing seed. Until the exposed pool is better understood, traders cannot cleanly separate a contained software flaw from a deeper product-reliability problem.

What matters next: migration speed and fresh outflows

What could limit further damage

The clearest positive signal would be behavioral, not just technical: fewer vulnerable balances remaining exposed. Coinkite already has fixed firmware available for every affected model and release track, and the protective move is to generate a new one on patched firmware and move their coins. Simply installing the update is not enough if users keep old seeds in place.

If migration is broad and fast, the event looks more like a depleting drawdown than an open-ended leak.

Where the pressure likely shows up first

The pressure is probably weakest for users who can show strong process discipline, and sharpest for unmigrated balances tied to old seeds. Even a passphrase can reduce immediate exposure, but it does not repair an affected seed; those users still should migrate as soon as practical.

For now, the most useful signals are migration speed and fresh outflows. If both stay quiet, the worst flow pressure may be fading.