Coldcard Wave 3: $116M in Bitcoin Sweeps Put Self-Custody Under Fire

Wave Three Turns a Coldcard Flaw Into a Trust Test for Hardware Wallets

This is not a one-off breach. It is a stress test for the self-custody promise. Galaxy Research identified a third wave of sweeps linked to weak Coldcard-generated keys, with the attacker now targeting smaller balances and changing how funds are collected onchain. That makes it more than a story about one vendor: it is a confidence shock for hardware wallets.

The scale is large enough to make even loyal users ask whether "cold" means safe, or only safer. Affected victims now total more than 5,200 individual addresses, with roughly 1,816 Bitcoin moved and nearly $116 million already swept. Those are meaningful liquidity figures, and they put pressure on the broader self-custody narrative.

The behavior matters too. The usual argument for hardware wallets is that attackers still have to trick the user. Here, Galaxy traced the damage to a wrong random number generator in old firmware, and the technical explainer says attackers did not need to touch the device at all. That is why this hits harder than a typical phishing wave or dApp exploit.

The debate is now clearer. Critics can say this is still a Coldcard-specific firmware issue. But the self-custody side has to explain why a seed-generation flaw can scale across thousands of addresses so quickly and still shake trust in the category.

Why the Mechanism Matters More Than the Headline

A 2021 firmware mistake changed the randomness pipeline

The market cares because this is not a speculative exploit. It traces back to a March 2021 firmware integration error. That error routed seed creation to a deterministic software pseudorandom number generator instead of the device's hardware RNG. In plain English, the wallet did not gather enough true randomness.

That changes the risk math. A typical wallet bug depends on user action, a malicious site, or a software payload. Here, weak randomness can make some private keys easier to narrow down without ever touching the device. That strikes at a basic assumption of self-custody: that the wallet creates secrets the attacker cannot plausibly guess.

How the attack works without touching the device

Block's analysis says an attacker can reproduce candidate output streams offline if they can estimate the device UID, timer state, and earlier RNG calls. Once those candidates exist, the attacker derives addresses from them and checks the public blockchain for matches.

That is a clean mechanism. It does not require network access, and it does not require the victim to sign anything unusual. It shifts the problem from "keep your seed secret" to "hope the candidate set stayed large enough." Coinkite estimates roughly 40 bits of effective entropy on the Mk3 and about 72 bits on later models, versus the 128 bits for a 12-word BIP-39 seed. That still does not amount to an instant break, but it is enough to damage trust in the size of the key space.

The patch stops future weakness, but it does not fix old seeds

Coinkite responded quickly, shipping emergency firmware on July 31 for affected models and release tracks. That matters because it stops new wallets from being generated the same way.

It does not rescue seeds already created under the bad firmware, however. Coinkite has told users to move their funds as soon as possible for affected devices, because restoring an old seed later carries the weakness forward. The patch protects the pipeline going forward, not wallets already built with weaker material.

What Investors and Custodians Should Watch Next

The main repricing risk is trust, not just demand

Galaxy has already flagged a third wave of sweeps, and the attacker has changed how funds are collected onchain. That gives exchanges and custodians a reason to widen screening beyond previously known addresses. If deposit rules, withdrawal holds, or firmware checks tighten, Coldcard-related liquidity could become less frictionless than the market assumes.

Where the exposure sits

The first ring of exposure remains Coinkite and the Coldcard brand. The deeper question is whether this starts to look like a process issue rather than an isolated brand glitch.

The attack is happening in a market that still sees hundreds of crypto hacks each year, but the scale here is large enough to make counterparties more sensitive to wallet provenance and key-generation hygiene.

What would shift the read

• Escalation: new sweep waves, new collection patterns, or broader exchange screening beyond Coldcard-affected users.
• Containment: no fresh linkage between new onchain sweeps and weak keys after the firmware fix.
• Clarity: a public conclusion that limits how much self-custody premium needs to be repriced.