A vulnerability in Coldcard hardware wallets, traced to a 2021 firmware build that skipped the device's randomness chip, has allowed attackers to steal over $130 million in Bitcoin. The exploit, which drains millions daily, has prompted some holders to move coins to exchanges and other storage — and, notably, into spot Bitcoin ETFs.
The firmware flaw
The bug dates back to a 2021 firmware update that bypassed Coldcard's dedicated hardware random-number generator. Without that chip, the wallet produced weak private keys that attackers could guess. The result: a steady drain of Bitcoin, now totaling more than $130 million, according to the facts provided. Coldcard has not yet issued a public statement on the timeline of the fix.
ETF inflows spike
Following news of the hack, spot Bitcoin ETFs managed by BlackRock, Fidelity, Grayscale, Morgan Stanley and others pulled in $626 million in fresh cash, per Farside Investors data. BlackRock's iShares Bitcoin Trust (IBIT) took the lion's share. The entire ETF category now manages $77.8 billion in assets, according to Coinglass.
Why ETFs, not hardware wallets
Bloomberg Intelligence senior ETF analyst Eric Balchunas suggested the inflows might not be directly tied to the hack, but argued that investors are better off trusting large fund managers like BlackRock — 25,000 employees and $15 trillion in assets under management — over small boutique firms like Coinkite, which has just five employees. BlackRock's spot Bitcoin ETF was approved by the U.S. SEC in 2024 and had the most successful launch in ETF history.
The timing isn't great for Coldcard. The hack is still active, and the ETF option offers a regulated, institutional-grade alternative. Whether the inflows are a direct flight from self-custody or just a coincidental wave, the numbers are clear: investors are putting money into the big guys.
Coldcard has not announced a patch or a recall. The drain continues. For now, the market is voting with its dollars — and those dollars are landing in ETF accounts.
