Morning Minute: The Coldcard Bitcoin Hack Nears $114 Million in Potential Losses
Coldcard, a widely trusted Bitcoin hardware wallet, was hit by one of the largest self-custody thefts ever after a firmware flaw let attackers regenerate private keys without the device. A March 2021 update used a weak software fallback instead of hardware randomness, reducing security to about 40 bits from 128 and making keys guessable. Researchers estimate about 1,367 BTC, or roughly $88.6 million, has been stolen across 4,585 addresses in three waves, with a possible fourth wave pushing losses toward $114 million. Galaxy says the exploit is ongoing and may affect every vulnerable device. Coinkite and Galaxy both suspect AI-assisted analysis helped find and automate the attack. The incident highlights a major threat to crypto self-custody and offline security.
