1,196 Wallets Drained in 41 Minutes
The Coldcard hardware wallet exploit that initially surfaced as a $38 million theft has ballooned to $70 million, according to a detailed forensic analysis published by Galaxy Research on August 1. The updated figures show that 1,082.65 Bitcoin was swept from 1,196 wallets in a single 41-minute window on July 30, nearly doubling the damage first reported.
The transactions occurred between 01:10 and 01:51 UTC across six blocks, with three intervening blocks containing nothing — suggesting the attacker broadcast in batches rather than continuously. The stolen funds currently sit across four addresses and have not moved. Early reporting captured only one of those addresses, which explains why the figure has grown substantially as investigators mapped the full scope.
How the Attack Rebuilt Keys Without Touching Devices
What makes this exploit unprecedented is that the attacker never accessed the physical wallets. Most crypto thefts require reaching the key — breaching an exchange, tricking a contract, or phishing credentials from a laptop. The defense has always been distance: hardware wallets keep keys on devices that never connect to the internet.
This attack rebuilt the key instead. Coldcard's firmware was supposed to draw seed randomness from a dedicated hardware generator. An internal build setting told it to skip that generator, and a supporting library checked only whether the setting existed rather than whether it was activated. Key generation fell through to a basic software substitute seeded from the chip's serial number and clock registers. The serial number is fixed factory metadata, and clock values are timing state that an attacker can narrow down or measure independently.
The result was that the range of keys the device could produce collapsed from unimaginably vast to computationally countable. Security researchers placed the range at roughly four billion possibilities on the Mk4, Q, and Mk5 models. Four billion is a large number for a human but trivial for a computer. The attacker generated candidate seeds on their own hardware, derived the addresses each would produce, and checked those against the public blockchain — all without the victim's device being involved at any point.
Systematic Enumeration Across Three Address Formats
Of the drained wallets, 1,183 used the modern native segwit address format, seven used an older standard, and six used a legacy format. Nobody targets a specific victim across three address formats simultaneously — that pattern is consistent with systematic enumeration, where the attacker checks each candidate seed against every address path it might have produced.
Owners cannot reliably determine whether their own seed sits within the reproducible range. There is no diagnostic test that reveals exposure, which means anyone who generated a seed on affected firmware must assume the worst rather than verify it. Coinkite, Coldcard's maker, has warned Mk3 owners and claims newer devices are unaffected, though independent reports place the Mk2, Mk4, Q, and Mk5 in scope as well.
The Attacker's Trail
The attacker made one significant mistake. The operator used a paid account at a well-known blockchain data provider to query source addresses during the sweeps. Internal logs from that provider matched the suspected workflow with extraordinary specificity — down to the number, timing, and sequence of requests. The provider appeared to be supplying ordinary services without indication of the queries' purpose, but the logs have been passed to authorities.
Galaxy warned that further waves are likely if owners do not move their funds. The proceeds have not been liquidated, but the knock-on effect of potential liquidation will weigh on Bitcoin pricing in the near term. This incident also reignites debate around self-custody risks, one of crypto's fundamental promises, and may accelerate the shift toward regulated custody solutions like ETFs. For earlier coverage of this developing story, see our report on the initial Coldcard security alert.
Binance Founder Calls for Wallet Diversification
The escalating damage prompted Binance founder Changpeng Zhao to publicly call for wallet diversification, urging users not to rely on a single hardware wallet brand. Zhao's intervention underscores the severity of the incident and the broader implications for the hardware wallet industry. If a single firmware flaw can compromise over a thousand wallets in under an hour, the concentration risk of relying on one manufacturer becomes painfully clear.
The exploit also raises uncomfortable questions about the hardware wallet supply chain. Coldcard devices are manufactured by Coinkite, a Canadian company that has built its reputation on security. The fact that a firmware setting could silently weaken the most critical security function — random seed generation — suggests that hardware wallet users need to demand greater transparency about the firmware running on their devices, not just the physical security of the hardware itself.
For continuous coverage of cryptocurrency security incidents and market intelligence, visit Bitnxt.
