Coldcard has admitted to a critical vulnerability that put millions of dollars worth of Bitcoin at risk. The hardware wallet maker urged users to treat fund migration as urgent, upgrade devices, generate a new seed, and carefully move funds. The flaw was disclosed at the end of July 2026, after users reported missing funds.
Coldcard's Urgent Warning
The company didn't mince words. In a notice posted after the disclosure, Coldcard told users to treat the situation as urgent. The recommended steps: upgrade the device firmware, generate a completely new seed phrase, and then transfer funds to the new wallet. The message was clear — don't delay.
Over $100M Gone — and Counting
Galaxy Research estimates the confirmed stolen amount is over $100 million. Some reports suggest the actual figure could be around $130 million. That's a lot of Bitcoin, and the number might still climb as more victims come forward. The vulnerability was discovered after users noticed funds missing from their Coldcard devices.
The Blockchain's Double-Edged Sword
Market commentator Joe Consorti argued that the attacker may struggle to spend a large portion of the stolen Bitcoin. His reasoning: each BTC is tracked on the public blockchain. That transparency makes it hard to launder or cash out big chunks without being spotted. It's a small comfort for those who lost funds, but it means the thief isn't home free.
What happens next? Coldcard is pushing users to migrate. The clock is ticking for anyone still holding funds on an affected device. The company hasn't said whether it will offer compensation or if a full forensic report is coming. For now, the advice is simple: move your Bitcoin.
