At least twelve separate hacker groups have stolen roughly $130 million from Bitcoin owners using Coinkite's Coldcard offline hardware wallets, according to blockchain security firms tracking the heists.

Galaxy Research first disclosed the campaign and pegged the losses near $130 million as of Tuesday. Tom Robinson, co-founder and chief scientist of Elliptic, told TechCrunch the figure is "roughly correct." The attackers are exploiting a flaw in Coldcard's seed-phrase generation that lets them reconstruct private keys without ever touching the victim's device.

What is actually being stolen?

The thefts target seed phrases — the master passwords that derive a Bitcoin wallet's private keys. Coldcard markets itself as a "cold" storage device whose keys never touch the internet. Researchers at Block's security team published a technical breakdown of the bug, titled "Predictable RNG fallback and 32-bit reseed in Coldcard firmware," showing that certain entropy paths inside the firmware produce guessable outputs.

Once attackers mapped the predictability, they ran the derivation offline at high volume. As Block's researchers put it, the hackers "cut keys at scale" instead of breaking into the safes storing them.

How does the 2021 code line enable this?

The vulnerable routine was introduced in 2021, according to victim accounts. Coinkite published a security advisory on Thursday and updated it Saturday, instructing users to update firmware and "migrate" to a freshly generated seed phrase. Coinkite did not respond to a request for comment from TechCrunch.

One victim, Jonathan Goodman, wrote on X that $1.6 million was drained from his Coldcard. "Perhaps the hardest part about this is that I did everything right," he posted. "I never shared my seed phrase with anybody. My devices never touched the internet. Everything was kept in multiple safes and safety deposit boxes." He added: "None of it mattered. All because the hardware that created the seed phrase originally had one line in their code from 2021 that had a vulnerability."

Why does a cold-wallet breach matter for custody debates?

Cold wallets occupy the conservative end of the self-custody spectrum. A successful attack on a device marketed as air-gapped undermines the threat model many long-term holders rely on, and it shifts the security burden from operational hygiene (seed handling, physical storage) to supply-chain and firmware assurance.

The campaign fits a broader pattern of escalating on-chain theft. TRM Labs' H1 2026 crypto-hacks report recorded more than 200 attacks on companies and protocols in the first half of the year, with cumulative losses exceeding $950 million.

What should Coldcard users do, and what is the exposure window?

Coinkite's advisory instructs affected users to update firmware and generate a new seed, then transfer funds to a wallet derived from the new phrase. Any funds left at addresses derived from the compromised seed remain recoverable by any attacker who reconstructs the same output. Migration is effectively a hard deadline for users still relying on the affected generation routine.

Coldcard's user base and the exact number of compromised devices remain undisclosed. Galaxy Research and Elliptic continue to monitor the drain, and additional hacker clusters beyond the initial dozen may emerge as more seeds prove predictable.