Coldcard Bitcoin hack: theft tops $111 million as victims lose over 1 BTC on average

The Coldcard Bitcoin hack has resulted in at least $111 million worth of stolen Bitcoin, according to new analysis from Galaxy Research.

The actual losses could be even higher. Galaxy Research estimates that the total amount stolen may eventually exceed $130 million as researchers continue to investigate additional transactions linked to the attack.

The data also shows that the attack mainly affected long-dormant Bitcoin wallets, with individual victims reporting a median loss of more than 1 BTC.

Coldcard Hack Mainly Hit Old Bitcoin Wallets

Galaxy Research analyzed 250 victim reports to better understand the scale of the Coldcard Bitcoin theft.

The analysis found that the typical stolen Bitcoin had remained untouched for about 3.5 years.

Around 88% of the stolen Bitcoin had been sitting in wallets for at least one year before the attack.

This suggests that the attackers were able to target wallets that had remained inactive for long periods rather than focusing only on recently created wallets.

The losses varied widely between victims.

According to the data:

• Median loss per victim: 1.022 BTC
• Average loss per victim: 4.04 BTC
• Largest reported individual loss: 58.97 BTC
• Median loss per address: 0.014 BTC
• Average loss per address: 0.212 BTC

The large difference between the median and average losses shows that a relatively small number of victims lost very large amounts of Bitcoin.

Bitcoin Theft Reaches $111 Million

The first major wave of the Coldcard attack began last week, when hackers stole more than $35 million in Bitcoin from affected wallets.

The theft continued over the following days as security researchers investigated the incident and Coldcard users were urged to move their funds.

Want to understand how the Coldcard vulnerability worked? Read our full breakdown: Everything You Need to Know About the Coldcard Bitcoin Wallet Hack

Galaxy Research confirmed that at least $111 million has been stolen so far.

Galaxy said it is still reviewing additional transactions and wallets to determine whether they are connected to the attack.

What Caused the Coldcard Bitcoin Hack?

The attack was linked to a firmware vulnerability affecting Coldcard Mk3 devices.

According to Coinkite, the issue affected devices running firmware beginning with version 4.0.1, released in March 2021.

The vulnerability caused some wallet seed generation to fall back to a weak software-based pseudorandom number generator (PRNG) instead of using the device's hardware-based random number generator. This significantly reduced the randomness used to create wallet seeds.

In simple terms, attackers could potentially narrow down the number of possible seed phrases and use that information to gain access to affected wallets.

Because Bitcoin wallets are controlled by their private keys, discovering the correct seed could give an attacker full control over the funds.

Why Dormant Wallets Were at Risk

The attack highlights a major risk associated with old Bitcoin wallets.

Many affected wallets had not moved their funds for years. While long-term holders often leave Bitcoin untouched for security and investment reasons, those funds can remain exposed if the wallet's original seed generation was compromised.

The Galaxy Research data shows that most stolen funds were at least a year old. This does not mean that dormant Bitcoin wallets are inherently unsafe. Instead, it shows why users should check whether their wallet was ever affected by the Coldcard vulnerability and whether its seed was generated under the affected conditions.

Coldcard Urges Users to Move Funds

Following the discovery of the vulnerability, Coinkite, the company behind Coldcard, urged affected users to take action.

The company acknowledged that the software problem had remained undetected and said its potential impact increased as affected firmware versions were used over time.

Coinkite has advised users to update their devices or move funds from affected wallets. Some Bitcoin holders have already moved their assets to other storage solutions, including exchanges, as they assess the risk.

However, users should carefully verify their wallet's security status and follow official guidance before moving funds.

Coldcard Hack Raises Broader Bitcoin Security Concerns

The scale of the Coldcard Bitcoin hack has raised new concerns about security across the Bitcoin wallet ecosystem.

The incident also shows why secure random number generation is critical for cryptocurrency wallets. A weakness in the process used to create a seed phrase can put an entire wallet at risk, even if the underlying Bitcoin network remains secure.

With confirmed losses already above $111 million and Galaxy Research warning that the total could exceed $130 million, the Coldcard incident is becoming one of the most significant recent Bitcoin wallet security events. For users with potentially affected devices, checking wallet status and following the latest security guidance should be a priority.