Coldcard users have lost $89 million after the Bitcoin hardware wallet was hacked, according to a report from Infosecurity Magazine.

The figure places the incident among the largest security failures attributed to a hardware wallet product in Bitcoin's history. Coldcard, manufactured by Canada-based Coinkite, markets itself on air-gapped, self-custody security — a positioning that makes a breach of this magnitude especially consequential for the hardware wallet segment.

At this stage, the public record behind the headline remains limited. Infosecurity Magazine's report confirms the aggregate loss figure and identifies Coldcard as the affected product, but key operational questions — the attack vector, the number of compromised devices, and whether the vulnerability sits in firmware, hardware tampering, or a supply-chain intermediary — have not been disclosed in the available reporting.

What does an $89 million hardware wallet breach mean?

Hardware wallets exist to move private key storage offline and away from internet-exposed software. A successful attack that drains funds from Coldcard users implies one of several scenarios, each carrying distinct consequences:

• A firmware compromise, in which malicious code signs transactions without the owner's consent
• A supply-chain interception, where devices were tampered with between manufacture and delivery
• A side-channel or hardware-level extraction of secrets from the secure element
• User-directed social engineering that abuses legitimate device functions

Each scenario implicates a different party — Coinkite, its logistics chain, or the end user — and the $89 million figure alone does not resolve that attribution.

For Coinkite, the commercial exposure is direct. Coldcard's customer base skews toward security-conscious Bitcoin holders who chose the device specifically for its air-gapped design and open-source firmware. A confirmed breach at this scale typically triggers device recalls, firmware audits, and a migration of users to competing products such as Ledger, Trezor, or BitBox.

Why the disclosure gap matters

Institutional users and self-custody operators rely on timely, technically precise disclosure to assess their own exposure. The crypto security sector has learned from prior incidents — from the 2020 Ledger customer data leak to multiple fake-wallet campaigns — that ambiguity around root cause prolongs reputational damage and invites litigation.

The $89 million figure, if confirmed by on-chain forensics firms such as Chainalysis or Elliptic, will also draw attention from exchanges and compliance teams. Stolen Bitcoin of this size typically moves through mixing services and cross-chain bridges, creating a multi-year tracing effort and potential freezing actions at regulated venues.

What happens next?

Expect Coinkite to face pressure within days to publish a technical post-mortem, identify affected firmware versions or device batches, and state whether the vulnerability remains exploitable. Until that disclosure lands, affected users' practical options are limited to migrating funds from potentially compromised devices to newly generated keys on independent hardware.

The incident also arrives as hardware wallet vendors face growing regulatory scrutiny of custody-adjacent products, and a breach of this size is likely to accelerate calls for formal security certification standards for self-custody devices.