Bitcoin News
By Steven Anderson
1 / 15
A Seed Flaw Baked In Since 2021. The problem traces back to a flaw in Coldcard's seed phrase generation code — and that flaw has…
2 / 15
Coldcard's "Low Risk" Label Now Under Fire. Here's where it gets uncomfortable for Coldcard. The company's own documentation describes its…
3 / 15
What Affected Users Should Do Now. The advice from Galaxy Research and the broader community is pretty consistent: check your setup,…
4 / 15
Jonathan Goodman did everything right. The Canadian entrepreneur kept his Coldcard hardware wallet locked in a safety deposit box, never touched the internet with it, followed…
5 / 15
He only found out because he happened to check his balances through Wasabi wallet software. The withdrawals were already done. Gone.
6 / 15
The problem traces back to a flaw in Coldcard's seed phrase generation code — and that flaw has apparently been sitting there since 2021.
7 / 15
Galaxy Research has now mapped out three distinct waves of attacks hitting Coldcard addresses. Across those waves, 4,585 source addresses were drained.
8 / 15
Alex Thorn from Galaxy Research noted that the compromised wallets had been dormant for an average of 3.18 years before they were hit. Long-term holders.
9 / 15
The three waves aren't identical, either. The first two shared transaction patterns — similar enough that Galaxy Research thinks they might point to a single operator.
10 / 15
What's striking is where the stolen Bitcoin is now. It's sitting still. The hacker-controlled addresses haven't moved the funds, which is unusual and doesn't make the victims…
11 / 15
Related: Coldcard Firmware Bug Drained Bitcoin Wallets Worth Nearly $70 Million
12 / 15
Here's where it gets uncomfortable for Coldcard. The company's own documentation describes its default seed-generation method as "low risk.
13 / 15
To be fair, Coldcard's manual does mention alternatives. Users can combine hardware output with dice rolls, which the company suggests as a way to reduce reliance on the device…
14 / 15
The tension here is real and it's not simple. Coldcard has to maintain reproducibility so users can verify firmware — that's a legitimate security concern in its own right.
15 / 15
Goodman's case is the most visible, but he's far from alone. The 4,585 affected addresses span multiple users, multiple wallets, multiple years of dormant holdings.
The Currency Analytics
Want the full story?