Over 1,800 BTC siphoned from 5,000 addresses. A single random number generator flaw. The Coldcard hardware wallet—a fortress supposedly built for the paranoid—has been breached not by physical extraction, but by a cryptographic ghost in the machine.
The context: a trusted brand, a silent leak. Coldcard, the Canadian-made hardware wallet revered by Bitcoin maximalists for its air-gapped design and open-source firmware, suffered a catastrophic failure: a vulnerability in its entropy source during private key generation. The attack surface was not a compromised supply chain or a phishing campaign—it was the code itself. Bitkey, Block's wallet team, detected the bleeding by tracing a paid account query on a blockchain data platform. Galaxy Research later confirmed the first wave of 1,082.65 BTC flowing into a single address, with the remainder trickling from hundreds of other compromised wallets. The total: 1,800+ BTC, valued at roughly $150 million at current prices.
The core: a cryptographic short circuit. The root cause is textbook—a degraded entropy source in the ECDSA nonce generation. When the random number generator receives insufficient entropy, the nonce becomes predictable, allowing an attacker to reverse-engineer the private key from a single signature. This is not a novel attack. The Sony PlayStation 3 private key leak in 2012 was identical: a fixed nonce. The 2013 Android SecureRandom bug that drained thousands of Bitcoin wallets was the same mechanism. Coldcard's implementation simply repeated history.
I have seen this pattern before. During my 2018 audit of 0x Protocol v2, I identified an integer overflow in the order book matching logic that could be triggered under high-frequency trading spikes. The exploit required a specific edge case, but the fix was straightforward. Here, the fix is cosmetic: Coldcard has released a patch to prevent future wallets from generating weak keys. But the 5,000 addresses already exposed are permanently compromised. Any new deposit into those addresses is a direct donation to the attacker.
Trust is a variable; verification is a constant. The attacker's methodology shows systematic precision. The 1,082.65 BTC remained unmoved after the initial transfer—a sign of either patient waiting for a safe exit or a lack of off-ramp liquidity. The remaining 700+ BTC was extracted from smaller addresses, likely via automated scripts. The attacker is not a novice; they understood the latency between discovery and disclosure. They exploited the gap.
Contrarian: what the bulls got right. The narrative this week is panic: “hardware wallets are not safe.” That is a half-truth. The vulnerability is not endemic to all hardware wallets, but it is a indictment of the “open-source, trust-the-community” model. Coldcard's firmware is open, yet the flaw survived for years—undetected by both the community and third-party audits. The bulls, however, correctly point to the deterrence power of on-chain forensics. The FBI is now involved. The attacker's identity has been narrowed down through the paid account trail. The 1,082.65 BTC sitting in a known address is a ticking bomb for the perpetrator, not the victims.
Silence in the code is where the theft hides. The attacker's inactivity suggests they are either trapped or waiting for a laundering infrastructure that can handle such volume. Mixers and cross-chain bridges are under increased scrutiny. The probability of recovery is higher than the market prices in. This is an asymmetric risk: the attacker's exit liquidity is a footprint.
Takeaway: the cost of convenience. Every exit liquidity pool leaves a footprint. The 5,000 affected addresses are not just a statistic—they are a lesson in trusting black-box randomness. Coldcard's brand will survive, but its aura of absolute security is gone. The industry must now standardize hardware random number generation or accept that “self-custody” is only as strong as the entropy source.
Verify everything. Assume nothing. The chain remembers what the CEO forgets. And in this case, the code remembered the nonce.