Coldcard’s $130M Firmware Flaw Forces Bitcoin Holders Toward Wall Street ETFs

Woofun AI reports that a severe vulnerability in Coldcard hardware wallets has triggered a mass migration of Bitcoin holdings, exposing the fragility of self-custody solutions. The crisis, rooted in a firmware flaw dating back to March 2021, has forced thousands of users to abandon their devices, leading to significant network congestion and a surge in exchange inflows. This incident underscores the growing tension between the ideological preference for self-custody and the practical security advantages offered by institutional financial products.

The scale of the breach is substantial, with confirmed losses stemming from three major attack waves and 14 smaller incidents. Galaxy Research, led by head of research Alex Thorn, has identified a possible fourth wave that could push the total stolen amount to 2,055 BTC, valued at approximately $130 million.

However, these potential losses remain outside the confirmed estimate pending further victim reports. At least 73 victims have contacted Galaxy for assistance in tracing their missing Bitcoin, providing data that helped researchers identify additional attack patterns. These insights suggest that at least 15 distinct attackers are now actively exploiting the vulnerability to reconstruct private keys.

Currently, about 90% of the stolen Bitcoin remains unmoved, with all coins linked to the first three confirmed waves still sitting at their initial attacker-controlled addresses. Galaxy has proactively shared these identified addresses with US law enforcement agencies, cryptocurrency exchanges, and blockchain investigation firms. This coordination aims to flag the funds if the attackers attempt to move them through centralized platforms, potentially preventing further loss. The static nature of these funds offers a window for intervention, but the threat remains acute as long as the addresses are not secured.

The technical root cause lies in a coding error within the Coldcard firmware that originated in March 2021. This flaw caused some devices to generate recovery seeds using a weaker software process rather than drawing sufficient randomness from the hardware random-number generator. Consequently, some seeds were generated with far fewer possible combinations than intended, creating a predictable pattern. Attackers exploited this weakness to reconstruct private keys remotely, bypassing the need to physically obtain the device or the owner’s recovery words. This fundamental flaw undermines the core security premise of the hardware wallet.

Remediation requires more than a simple firmware update. While installing the security update prevents the creation of additional weak seeds, it cannot protect a wallet whose recovery phrase was already generated through the flawed process. Coinkite, the manufacturer of Coldcard, has urged users to create a new seed and transfer their Bitcoin to a secure address. The threat remains active because every affected wallet stays exposed until its funds are moved to an address derived from a secure seed. This necessitates a complex migration process for users who must generate an entirely new recovery phrase.

Woofun AI data shows that the rush to migrate funds has severely congested the Bitcoin network. Transactions waiting in Bitcoin’s mempool surged from about 33,000 to roughly 96,000, marking the highest level since June 20. This spike occurred as thousands of holders attempted to move their funds simultaneously to escape the vulnerability. The network congestion highlights the systemic risk of coordinated mass migrations, which can degrade transaction speeds and increase fees for all users. The mempool surge serves as a tangible indicator of the panic and urgency driving the current market dynamics.

Part of this migration has flowed into centralized exchanges as users seek an immediate destination for Bitcoin removed from vulnerable wallets. CryptoQuant data shows that deposits from smaller holders reached their highest level since Feb. 6. Some users have moved funds into existing custodial accounts while deciding whether to create another self-custody wallet or switch hardware providers. These inflows increase the amount of Bitcoin immediately available for trading, potentially adding to short-term sell-side pressure.

However, this does not necessarily indicate an intent to sell, as some deposits may represent temporary custody arrangements.

Security warnings have intensified as scammers exploit the confusion surrounding wallet migrations. Trezor, a competitor unaffected by the Coldcard incident, has warned users never to share their recovery seeds or enter them into websites, applications, or forms supplied through unsolicited messages. The company emphasized that recovery words should only be entered directly on a Trezor device during wallet restoration. Users are urged to ignore migration instructions received through email, messages, or phone calls. These warnings reflect the heightened risk of phishing attacks targeting users who are already under pressure to move their funds.

The movement toward exchanges and the growing risk surrounding wallet migrations have strengthened the argument for holding Bitcoin through regulated investment products. Balchunas noted that relying on ETF issuers and their custodians may now appear more attractive compared to depending on a small hardware wallet manufacturer. ETF issuers are large financial institutions with decades of experience safeguarding client assets, whereas Coldcard is operated by a Canadian company with a small workforce. This contrast highlights the resource disparity between institutional custodians and niche hardware providers.

There is no evidence that Coldcard users have directly purchased ETF shares as a result of the exploit, and the increase in exchange deposits may prove temporary as holders create new wallets and return to self-custody.

However, the breach has nonetheless changed the calculation for investors deciding where to keep their Bitcoin. Self-custody removes dependence on a bank, exchange, or fund manager, but it also leaves users responsible for the hardware and software that create their private keys. For holders now trying to escape weak seeds while avoiding phishing attacks, the institutional structure once criticized for placing Bitcoin in Wall Street’s hands may offer the simpler option.