Coldcard hack steals $100M in bitcoin from thousands of wallets

A hack of Coldcard bitcoin hardware wallets has stolen over $100 million US in bitcoin, affecting thousands of users and prompting urgent warnings to move funds. Toronto-based Coinkite, which makes Coldcard, disclosed a software bug allowing hackers to reconstruct wallet seed phrases without physical access. Blockchain firm Galaxy Research confirmed 1,596 bitcoin stolen from roughly 7,300 addresses across three attack waves, with a possible fourth raising losses to about $130 million US. The vulnerability originated in March 2021, when affected firmware used a predictable pseudo-random generator instead of a secure hardware-backed one. Coinkite has released firmware updates, but existing seed phrases remain at risk, and users are advised to migrate funds to new wallets or exchanges.