Coldcard’s $130 million crisis is pushing Bitcoin back into Wall Street’s hands
A Coldcard hardware wallet flaw dating to March 2021 has led to theft of at least 1,596 BTC from about 7,300 addresses, with Galaxy Research confirming three major attack waves and 14 smaller incidents. A possible fourth wave could lift losses to 2,055 BTC, but that remains unconfirmed. The bug caused some wallets to generate weak recovery seeds, letting attackers reconstruct private keys remotely. Firmware updates stop new vulnerable seeds, but already affected wallets stay exposed until funds move to a newly generated secure seed. The exploit has triggered a rush to migrate funds, boosting Bitcoin activity to multi-month highs, increasing mempool congestion, and sending more coins to exchanges while users seek temporary custody or new wallets. At least 15 attackers may be involved, and most stolen coins have not yet moved. The situation has also fueled phishing, with scammers impersonating support and migration tools. Some observers say the breach may push users toward spot Bitcoin ETFs and institutional custody.
