Coldcard Losses Near $116 Million: Why Bitcoin Holders Should Move Funds Now

Coldcard losses have reached roughly $116 million

This is still a live money-flow event, not a closed hack headline. Galaxy Research has traced approximately 1,816 Bitcoin worth nearly $116 million out of Coldcard wallets tied to the flaw, across more than 5,200 individual addresses.

The speed of the July 30 sweep stands out. Attackers drained 1,196 Bitcoin addresses in 41 minutes, taking 1,082.65 BTC in one burst. That does not prove hardware wallets are generally unsafe. It does show how quickly confidence in a compromised self-custody setup can erode when funds are moved quickly.

Waiting is not neutral here. Coinkite shipped emergency firmware on July 31, but installing it does not repair a seed that was already created by vulnerable firmware.

Why the vulnerability is still exploitable

The core problem is not only a weak device. It is the seed material that was already generated. A March 2021 firmware integration error routed seed generation to a software pseudorandom number generator instead of the device's hardware random number generator. In practice, that changes the attack from breaking the hardware to reproducing the random stream.

Why "wait and see" still leaves funds exposed

Once the weak randomness path is understood, attackers can generate candidate seeds offline and test them against public blockchain data. Block says that process depends on UID information, timer state, prior RNG-call history, and derivation cost. Coinkite has estimated effective entropy at roughly 40 bits on the Mk3 and about 72 bits on the Mk4, Mk5 and Q. Even without a published reconstruction of any victim's seed, that does not change the risk for holders whose coins still sit on exposed addresses.

This is why the advisory still matters so much. Coinkite shipped emergency firmware for every affected model on July 31, but Galaxy has said the attacks are still happening. Patching limits future damage; it does not undo past exposure.

What Coldcard holders should do now

If your Bitcoin came from a single-sig Coldcard created on vulnerable firmware, the cleanest move is to create a fresh wallet on patched firmware and transfer the coins. Coinkite's instruction is explicit: generate a new one on patched firmware and move your coins.

This has also become a broader self-custody debate. Concerns intensified after losses were reported at nearly 600 bitcoin worth roughly $38 million, and later near $114 million after a fourth wave. The practical response, however, is exposure management rather than theory. A fresh seed from patched tooling removes the weak-randomness path. Restoring the old seed to updated firmware does not.

What would reduce the market concern

The situation becomes less urgent if stolen totals stop rising and no new large flows move toward exchanges. If that happens, the incident looks more like a security cleanup than an active market overhang. If the outgoing flows keep expanding, the narrative can stay under pressure.