An attacker exploited weak seeds generated by certain Coldcard hardware wallets to steal bitcoin worth tens of millions of dollars on July 30. The theft hit hundreds of addresses in a tightly coordinated burst lasting about 25 minutes, according to Galaxy Research. Broader analysis later connected roughly 1,196 addresses to the exploit, making it one of the more significant hardware wallet breaches this year.
The 25-minute heist
Galaxy Research tracked the core theft to a single 25-minute window on July 30. During that time, the attacker drained funds from hundreds of addresses in rapid succession. The speed and precision suggest automated scripts rather than manual intervention. The total stolen amount is in the tens of millions, though the exact figure may rise as more addresses are identified.
Weak seeds, big consequences
The vulnerability stems from weak seed generation in certain Coldcard models. When a wallet's seed phrase is generated with insufficient entropy, an attacker can brute-force or predict the private keys. In this case, the attacker appears to have identified and targeted wallets with such weak seeds. The exploit did not affect all Coldcard users, only those whose seeds were generated under specific conditions.
The broader fallout
Galaxy Research's analysis eventually linked roughly 1,196 addresses to the exploit. That number includes both the directly drained addresses and potentially related wallets. The incident raises questions about hardware wallet security standards and the responsibility of manufacturers to ensure robust entropy sources.
What comes next
Coldcard has not yet released a public statement or patch. Affected users are urged to move funds to new wallets with securely generated seeds. Security researchers are likely to publish a detailed breakdown of the exploit in the coming days. Law enforcement may also get involved given the scale of the theft.
