Community Trust ScoreVerified
A second wave of coordinated Bitcoin thefts is tearing through Coldcard hardware wallet users. Galaxy research head Alex Thorn went public on social media Monday, saying 448.7 BTC is potentially at risk — and the clock is ticking for anyone who still holds their keys.
Thorn tracked hundreds of transactions hitting 709 potential victim addresses. The sweep rate is running at an average of 13.8 transactions per block, which is dramatically higher than anything seen before the attacks started. And the pattern is unusual: each victim’s Bitcoin isn’t going to one central collection wallet. Every theft routes to a fresh, unique address. Some of those funds have already moved again — second-hop transfers that make tracing harder and recovery pretty much impossible once confirmed.
“These are LIKELY Coldcard victims,” Thorn said, flagging the transaction patterns as characteristic of wallets compromised by the underlying flaw.
The Firmware Flaw Behind the Losses
The root cause is a firmware bug in Coldcard devices. The flaw causes wallets to generate seeds with insufficient entropy — meaning the randomness baked into key generation isn’t actually random enough. That’s a catastrophic failure for any hardware wallet. Weak entropy means an attacker who knows about the flaw can calculate or brute-force the private keys, then drain funds without ever touching the physical device.
The numbers are brutal. Over $90 million in Bitcoin has reportedly been stolen since the vulnerability came to light. Thousands of wallets are believed to be compromised. The 448.7 BTC figure Thorn cited on Monday came after an earlier attack wave just days before, so the losses are stacking fast. No official figure has been confirmed by Coldcard’s manufacturer — because, as of now, the company hasn’t said anything publicly at all.
That silence is its own problem.
A Narrow Window to Fight Back
Thorn laid out one potential lifeline for users who still control their keys: broadcast a conflicting transaction with a higher fee before the attacker’s transaction confirms. Bitcoin miners prioritize higher-fee transactions, so a fast-enough counter-move could theoretically bump the malicious sweep out of the queue and redirect funds to a safe address the victim controls.
But it’s a narrow window. Once the attacker’s transaction confirms on-chain, it’s done. The Bitcoin is gone. The only users who can attempt this are those who still hold their private keys and can act before the block is mined. For anyone who’s already seen their funds move to a second-hop address, that option is off the table.
Thorn also noted that similar transactions are sitting unconfirmed in the mempool right now, which means more victims are likely still in the danger zone — and some of them probably don’t know it yet.
The mechanics of the attack make it especially hard to fight at scale. Because the stolen Bitcoin fans out to unique destination addresses rather than pooling in one wallet, there’s no single choke point to freeze or flag. Every theft is its own isolated chain of transactions. That dispersal is almost certainly deliberate — it scatters the trail and makes any centralized recovery effort far more complicated.
Hardware wallets are supposed to be the gold standard for Bitcoin custody. The whole pitch is air-gapped security, physical key storage, protection from remote exploits. A firmware flaw that undermines seed generation at the foundational level cuts against everything that pitch is built on. Entropy failures aren’t new in cryptography — they’ve burned developers and users before — but seeing one surface in a widely-used consumer device at this scale is a serious blow to confidence in the hardware wallet category broadly.
No Response from the Manufacturer
Coldcard’s manufacturer hasn’t commented on the vulnerability or the ongoing thefts. No patch timeline. No public advisory. No guidance for users beyond what independent researchers like Thorn are piecing together from on-chain data.
That leaves affected users in a rough spot. They’re essentially relying on community-driven analysis and their own ability to move fast. For less technical users — people who bought a hardware wallet precisely because they didn’t want to manage complex security decisions themselves — that’s a hard ask.
Security researchers are watching the mempool closely for more sweeps. The fee-bumping strategy Thorn described is the best tool available right now for anyone still holding vulnerable keys, but it requires knowing you’re at risk, understanding how to construct and broadcast a raw transaction, and doing all of that faster than an automated attacker who’s already running scripts.
The 448.7 BTC figure covers the second wave alone. Total losses across both waves, per Thorn’s reporting, are part of the broader $90 million-plus figure tied to the firmware flaw disclosure.
Frequently Asked Questions
What caused the Coldcard Bitcoin thefts?
A firmware flaw in Coldcard hardware wallets causes devices to generate wallet seeds with insufficient entropy, allowing attackers to derive private keys and drain funds. Over $90 million in Bitcoin has reportedly been stolen as a result.
How many wallets and how much Bitcoin are at risk in the latest wave?
Galaxy research head Alex Thorn identified 709 potential victim addresses with 448.7 BTC at risk in the most recent wave, following an earlier attack that occurred just days prior.
