Coldcard Losses Hit $116 Million. Why That Fourth Wave Still Matters for Bitcoin

Coldcard losses reached $116 million, and the fourth wave kept the exposure open

Galaxy Research found four waves of thefts targeting more than 5,200 individual addresses, with approximately 1,816 Bitcoin moved in total. That pattern points to repeated sweeping through the same vulnerability rather than one isolated breach.

Coldcard was sold as secure offline storage, so the incident matters beyond the dollars lost. It raises a broader self-custody question: if a hardware wallet designed to keep keys offline can be compromised through weak seed generation, how secure are affected backups in practice?

The unresolved attacker identity also matters. Investigators have not linked the incident to a specific group, which makes it harder for the market to quickly categorize the risk and move on. As long as the exploit path remains active, the event looks less like a closed headline and more like an ongoing exposure.

Coinkite has urged users to move funds to fresh seeds before reading further. Bitcoin has held up better than many expected, but the fourth wave shows the exposure had not fully cleared by the time the story gained traction.

The issue was weak seed generation, not a Bitcoin protocol flaw

The breach was a wallet-generation failure, not a break in Bitcoin itself no weakness in Bitcoin's cryptography. On July 30, attackers drained about $70.2 million worth of bitcoin in about 41 minutes, with the first sweep running from roughly 1:10 AM to 1:51 AM UTC. For investors, the key point is simple: funds moved because some seeds were weaker when created, not because the chain was compromised.

Why the vulnerability mattered

Affected Coldcard firmware was supposed to generate seeds with stronger randomness. Instead, some devices produced far less entropy than intended. Affected Mk2 and Mk3 firmware may have generated seeds with only about 40 bits of entropy, while affected Mk4, Mk5, and Q devices may have produced seeds with about 72 bits of entropy.

That reduction made prediction feasible for attackers. They could generate candidate recovery phrases, derive the corresponding addresses, and test whether any controlled real balances. The mechanism did not require physical access to the device.

Fixed firmware also does not repair an already-weak seed. Coinkite says updating the software does not change or repair an existing seed, and funds controlled by seeds generated on affected firmware are at risk when the exception criteria do not apply. That is why migration to a fresh seed remains the main fix.

The July 30 drain also happened before Coldcard published its first advisory, which likely extended the window for opportunistic sweeping. That makes this less a story about Bitcoin's security and more a story about wallet-setup risk and response timing.

Bitcoin's exposure depends on whether the sweeps keep spreading

The market debate is not really about whether Bitcoin itself was broken. It is about whether this remains a Coldcard-specific cleanup or becomes a broader supply overhang.

Why the bear case still exists

Bears are focused on one mechanism: if more vulnerable wallets are found, sell pressure can keep showing up before the market fully absorbs it. Galaxy already saw the pattern expand beyond the first sweep, with a third wave targeting smaller balances. That matters because smaller balances can be easier to miss in market monitoring.

The scale is already meaningful. Coldcard thefts have now reached approximately 1,816 Bitcoin across more than 5,200 individual addresses. The risk is less a sudden crash signal and more a slow drain from balances many holders assumed were dormant.

What would strengthen the bull case

The more constructive view is that this becomes a migration event rather than a lasting market overhang. Coldcard has already released fixed firmware for every affected model and track, including Mk2/Mk3 version 4.2.0 or later and Mk4/Mk5 standard version 5.6.0 or later.

If holders migrate affected funds to new seeds and the sweeps slow or stop, the incident is more likely to stay confined to Coldcard users and Coinkite's reputation. If new waves keep appearing after the patch, the market is more likely to treat it as an active supply problem.