A major security breach in Coldcard hardware wallets has raised fresh concerns about Bitcoin self-custody after hackers  exploited a flaw in wallet's recovery seed generation process, which led to the theft of around 1,816 BTC worth of nearly $116 million.  

The attack took place in four consecutive waves, impacting over 5,200 Bitcoin addresses, according to blockchain intelligence platform Galaxy Research. Once the hacker successfully reconstructed recovery phrases from the vulnerable Coldcard, they quickly transferred the funds from compromised wallets. The attackers have not been identified and no confirmed link has been established to any state-sponsored hacking group.

The vulnerability has been backdated to a 2021 upgrade in the firmware that allowed for wallet recovery phrases to be generated with low randomness. According to Block's Bitcoin engineering and security teams, the flawed process would allow for the creation of some seed phrases that are predictable for hackers to be able to steal wallets without ever interacting with the physical hardware through brute force methods.

AI Raises New Questions About Crypto Security

The incident has sparked a debate on the increasing importance of artificial intelligence in cybersecurity. The current AI tools are even more effective at discovering vulnerabilities in the open-source cryptocurrency software, especially when compared with manual audits, says SlowMist founder Yu Xian.

He said, "I would recommend doing this," referring to the use of AI-powered code reviews for blockchain projects. Yu Xian also cautioned that hackers today have fewer restrictions than defenders, allowing them to use increasingly  advanced AI models to find vulnerabilities.

Industry Response & Investor Concerns

Coinkite, the manufacturer of Coldcard, recommended that anyone who created a wallet by using the affected firmware versions should withdraw all their Bitcoins and create new wallets with the new software immediately.

In an open statement, the company said, "The last three days have been some of the hardest in this company's history, and for a lot of the people reading this, they've been something much worse.”

The Coldcard hack coincides with “one of the busiest times of the crypto attack season,” according to the TRM Labs. The blockchain analytics firm also recorded 207 different crypto security incidents within the first half of the year, the highest number for any six month period. The total industry losses were around $972 million compared with the $2.3 billion stolen for the first six months of 2025.

The attack has also reignited the debate about the pros and cons of self-custody vs centralized exchanges. Binance CEO Changpeng (CZ) Zhao said that "I believe in self-custody, but it's a trade-off.” Bitcoin's market price hasn't seen much of an impact after the hack, but the $116 million Coldcard exploit has been one of the most significant hardware wallet security incidents in recent years. 

In conclusion, the episode highlights the need for ongoing security audits and assessments for all open-source wallets, especially as the digital asset space continues to evolve with new threats and challenges in the form of AI attacks.

Also Read: Bitcoin Price Analysis: Will BTC Recover to $63K Despite ETF Outflows?

FAQs:

1. How much Bitcoin was stolen in the Coldcard wallet hack?

Attackers stole around 1,816 BTC, valued at nearly $116 million. According to Galaxy Research, the theft occurred across four coordinated waves and affected more than 5,200 Bitcoin addresses.

2. What caused the Coldcard wallet vulnerability?

The flaw was linked to a 2021 firmware update that weakened the randomness used to generate recovery seed phrases. This made some phrases predictable enough for attackers to reconstruct them using brute-force techniques.

3. Did hackers need physical access to the Coldcard devices?

No. Once attackers recreated the vulnerable seed phrases, they could access and drain the wallets remotely. They did not need to possess or physically interact with the affected hardware devices.

4. What should affected Coldcard users do?

Users who generated wallets with the affected firmware should create a new seed using updated software and transfer their Bitcoin immediately. They should also consider using a strong passphrase for additional protection.

5. Does the Coldcard hack mean centralized exchanges are safer?

Not necessarily. Centralized exchanges reduce the technical burden of self-custody but introduce platform and counterparty risks. The incident shows that both methods require careful security evaluation and risk management.