Losses from a security exploit affecting Coldcard Bitcoin hardware wallets have reached $88 million, with attackers actively draining funds from affected devices in one of the year’s most significant Bitcoin wallet security incidents.
The exploit centers on Coldcard, the hardware wallet built by Coinkite, and has seen attackers systematically emptying user wallets, according to reporting from Decrypt. The scale of the losses places the event well beyond a routine firmware advisory, striking at the self-custody segment that Bitcoin holders often treat as the safest option.
Coinkite has tied the risk to seed generation on specific hardware, publishing a warning covering the Coldcard Mk3 and how affected seeds were produced. We previously detailed how the Coldcard Mk3 seed risk warning was linked to a large BTC transfer, an early signal of the exposure now being counted in the broader total.
How the Damage Estimate Reached $88 Million
The reported figure reflects funds drained from wallets exposed by the vulnerability rather than a single transaction. Coinkite has published a technical backgrounder on the vulnerability, framing the issue around how affected seeds were generated on the device.
Because the flaw sits at the seed-generation layer, the assets being counted are those held in wallets created under the vulnerable conditions. That distinction matters: the total tracks compromised seeds rather than a breach of a single exchange or custodian.
Who Is Exposed
The most exposed users are holders whose Coldcard seeds were generated under the flagged conditions described in Coinkite’s advisory. Because these are self-custodied Bitcoin wallets, funds move directly from user-controlled addresses once a seed is compromised, leaving little intermediary recourse.
The incident cuts against the assumption that hardware wallets remove trust concerns entirely. It reframes the risk from where keys are stored to how they were created, a distinction most holders rarely scrutinize.
Bitcoin Holders Are Moving Funds Back to Exchanges
One measurable market response has been a shift in custody behavior. Unlike the FTX collapse, the exploit has prompted some investors to send Bitcoin back to exchanges, CoinDesk reported, reversing the self-custody flight typically seen after a trust shock.
That inversion is notable because prior custody crises pushed holders off exchanges and onto hardware wallets. Here, the hardware layer is the point of failure, so exchange custody is being treated by some as the safer near-term option. Related exchange-flow dynamics have been visible elsewhere, including a record streak in the Coinbase Bitcoin premium index.
What to Watch Next
Coinkite’s public advisories remain the primary confirmed response, with the seed-generation warning and technical backgrounder outlining the affected scope. No further mitigation timeline has been established in the available reporting.
The open questions are whether the loss tally rises as more affected seeds are identified and how exchange inflows evolve if holders continue moving funds off hardware wallets.
FAQ
What is the Coldcard exploit? A security vulnerability affecting Coldcard Bitcoin hardware wallets, tied by Coinkite to how seeds were generated on certain devices, that has allowed attackers to drain funds.
How large are the losses? Reported losses from drained wallets have reached the tens of millions, with the running total cited at the level noted above.
Are Bitcoin users still at risk? Holders whose seeds were generated under the flagged conditions remain the most exposed; Coinkite’s advisories describe the affected scope.
What is the market impact? Some investors have responded by sending Bitcoin back to exchanges, an unusual reversal of the self-custody trend seen after past trust shocks.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
