Against that backdrop, the Coldcard incident has drawn attention for its mechanism rather than its direct price impact. Galaxy Research traced 1,082.65 BTC — worth about $70.2 million at the time — moving from 1,196 addresses in a 41-minute window between 01:10 and 01:51 UTC on July 30, roughly 30 hours before Coldcard issued its first security advisory. The stolen funds sit in four addresses and have not moved.
The exploit did not require physical access to the devices. A firmware bug in Coldcard Mk3 units running versions 4.0.1 through 5.0.3 (released March 2021 onward) caused seed generation to fall back to a weak software PRNG instead of the hardware true random number generator, producing seeds with only ~40 bits of entropy rather than the intended 128. Attackers could reconstruct private keys offline and sweep wallets without ever touching the hardware.
Coinkite initially warned only Mk3 users, then extended precautions to Mk4, Mk5, and Q devices. Researchers warn that owners cannot reliably tell whether their seeds were generated on vulnerable firmware, leaving an unknown number of additional wallets at risk. The episode has also driven Bitcoin's social sentiment to a historic low: Santiment data shows a positive-to-negative commentary ratio of just 0.58, the lowest since tracking began, eclipsing readings during the FTX collapse and the COVID-19 crash.