Coldcard Hack Passes $88 Million: Kraken's Call for Audits Exposes a Real BTC Risk

The Coldcard drain is still active

The most important detail here is not the headline total. It is that the drain is still happening. Galaxy has now tracked about 1,367 BTC across roughly $88.6 million and 4,585 addresses, after the first major sweep on July 30, when an attacker cleared 1,196 Bitcoin addresses in 41 minutes and took 1,082.65 BTC. This is less like a historical breach and more like a live leakage event, which means more exposed coins could still be pulled before owners move them.

Why the dormancy of stolen coins matters

This is not only a wallet-security story. Galaxy said the stolen coins had sat untouched for years, with an average dormancy of 3.18 years. If those funds finally leave cold storage, the market is not just watching a privacy incident. It is watching delayed supply hit the chain.

A wallet failure, not a Bitcoin protocol failure

Bulls will say this is still a limited hardware-wallet problem, not a break in Bitcoin itself. That is mechanically true. Bears will say the practical impact still matters because vulnerable addresses are still being emptied. The urgency is real even if the fault is confined to affected device firmware.

Why the patch did not solve the whole problem

After about $88.6 million in observed losses, the real question is residual exposure: how many weak seeds were already created before the fix?

What broke in Coldcard's seed generation

The problem traces to a March 2021 firmware integration error that routed Coldcard seed generation to a software PRNG instead of the device's hardware RNG. That lowered the effective randomness behind some generated seeds. Block's analysis says an attacker who can constrain device UID, timer state, and prior RNG-call history can reproduce candidate output streams offline and test them against public blockchain data.

Why updating firmware does not repair old seeds

Coinkite shipped emergency firmware on July 31, but installing it does not repair an existing seed. If a weak seed was already generated, that weakness remains in the words themselves.

That is why migration matters more than version-chasing. Coinkite says restoring the old seed to updated firmware or another wallet carries the weakness forward. The practical instruction is straightforward: generate a new seed on patched firmware and move the coins.

Why the exposure debate still matters

The mechanism is specific: this is a seed-creation flaw, not a general Bitcoin vulnerability. But the practical risk still depends on how many affected seeds were already issued. Galaxy has said every single-sig Coldcard address created after that 2021 update may eventually be drained. For holders who have not yet migrated, that makes this an active risk management issue, not a theoretical one.

What holders should do next

If you hold single-sig Bitcoin generated on an affected Coldcard, the better response is targeted migration, not a panic trade into the first convenient wrapper. Galaxy continues to describe the activity as ongoing, with about $88.6 million across 4,585 addresses already observed. For spot BTC, rapid fear-driven moves can stress liquidity before cleaner destinations are ready.

Risk is not the same in every setup

• Single-sig Coldcard holders: The exposure is real and actionable. The issue traces to a March 2021 firmware integration error, and patched firmware alone does not fix an already-issued weak seed. Moving exposed funds to a fresh setup is the cleaner fix.
• Multisig users: The protection depends on the full setup. Multisig helps only if the quorum is not built entirely from affected devices.
• Custodial or wrapper users: The immediate risk is less about seed recovery and more about concentration and sentiment if affected holders move funds toward centralized venues.

Why the audit debate matters beyond one wallet

The broader lesson is that key generation, seed storage, and device provisioning need to be taken more seriously across the industry. If audits and hygiene standards improve, the result should be more accountability, not a wholesale turn away from self-custody.

A more measured near-term outlook

In the short run, this incident can pressure BTC through panicked flows. In the longer run, it does not have to damage the self-custody case if migration is orderly and security standards become more measurable.