A critical bug in Coldcard hardware wallets allowed attackers to drain between 1,300 and 2,000 bitcoins from users. The vulnerability, which stemmed from weak entropy in the device's random number generation, went unnoticed for years. Over 11,000 bitcoins were subsequently moved to custodial exchanges, raising fresh questions about the security of self-custody tools.
The bug in the chip
The exploit didn't rely on sophisticated spyware or physical tampering. Instead, it targeted the wallet's entropy source — the randomness used to generate private keys. If that randomness is low, keys become predictable. Attackers could reconstruct them and sweep funds. Coldcard, a popular hardware wallet among Bitcoin maximalists, had shipped devices with this flaw for an unknown period before it was discovered.
The company has since released a firmware patch, but the damage is done. Users who generated keys during the vulnerable window are at risk. The exact number of affected wallets isn't public, but the stolen bitcoin haul — worth tens of millions at current prices — makes this one of the more costly hardware wallet incidents in recent memory.
How many coins were taken?
Estimates put the theft at 1,300 to 2,000 bitcoins. That's a wide range, reflecting the difficulty of tracing every compromised key. What's clearer is the aftermath: more than 11,000 bitcoins flowed into custodial exchanges after the hack. Some of that may be legitimate movement by users fleeing the wallet, but a chunk is likely the attacker cashing out or laundering proceeds.
The numbers underscore a paradox. Hardware wallets are supposed to eliminate the need to trust third parties. Yet when a hardware wallet itself is flawed, the promise of self-custody takes a hit. The article that reported the hack argues that self-custody remains essential, pointing to Bitcoin's original purpose: removing trusted intermediaries. But it also acknowledges that no tool is perfect.
The piece draws a wider economic contrast. It notes that in 1933, Executive Order 6102 forced Americans to surrender gold, effectively confiscating private holdings. The gold standard was later abandoned, leading to fiat currency and persistent inflation. Today, the U.S. national debt sits at roughly $40 trillion, debt-to-GDP is 123%, and annual interest payments top $1 trillion. The 2008 financial crisis, the article argues, was never truly resolved — just papered over.
In that light, the Coldcard hack is a reminder that self-custody isn't about perfection. It's about reducing reliance on systems that can be debased or seized. A buggy hardware wallet is a risk, but so is a bank run or a government decree. The question isn't whether one option is flawless — it's which set of risks you're willing to live with.
For now, Coldcard users should update their firmware and, if they generated keys during the vulnerable period, consider moving funds to a new wallet with fresh entropy. The broader industry will be watching to see if hardware wallet makers can tighten their random number generation — and whether the next bug will be caught before it's exploited.
