Coldcard firmware flaw: $100M+ BTC theft confirmed, possible 4th wave
Galaxy Research says the Coldcard firmware flaw thefts are now confirmed at 1,596 BTC (about $100M+) stolen from roughly 7,300 addresses across three major attack waves and 14 smaller incidents. A suspected fourth wave is possible at medium-high confidence, which could lift total losses to 2,055 BTC (about $130M). Galaxy kept the fourth wave outside “confirmed” totals because victims have not reported back yet; 73 victims have contacted the firm so far and helped verify the first three waves.
On-chain, about 90% of the stolen bitcoin has not moved, and attacker/victim addresses have been shared with US federal law enforcement, exchanges and cyber investigators while sweeps are described as ongoing. Galaxy ties the incident to a March 2021 Coldcard firmware build error: a configuration setting skipped the device’s hardware random number generator, and key generation fell back to a software substitute seeded from chip serial/timer data. A fixed firmware shipped July 31, but it cannot repair seeds already generated with the vulnerable setup.
For traders, the immediate market impact for BTC is likely limited, but headlines around the Coldcard firmware flaw can temporarily affect risk sentiment toward self-custody. The longer-term implication is a heightened focus on operational security, especially for users who delayed Coldcard firmware updates after the vulnerability surfaced.
Neutral
This is primarily a self-custody hardware-wallet incident. Even though the confirmed Coldcard firmware flaw theft now exceeds $100M and a possible 4th wave could raise losses to about $130M, Galaxy notes that roughly 90% of the stolen BTC has not moved yet. That reduces immediate sell-pressure on exchanges from this specific hack.
Short term: traders may see temporary risk-off sentiment around self-custody and security headlines, but BTC’s price impact is likely muted without evidence of large, imminent distribution to liquidity venues.
Long term: operational-security focus could drive more users to update firmware or migrate seeds, but that is more a structural behavior change than a direct BTC demand shock. Overall, the information flow raises concern but does not clearly translate into near-term BTC bearish fundamentals.