Coldcard Hacker Drains $7.7 Million in Bitcoin From Major Vaults

How Did the Attacker Access the Vaults?

An attacker has moved approximately $7.7 million in Bitcoin linked to a series of Coldcard hardware wallet breaches, according to Galaxy Research. The funds represent about 45% of the total Bitcoin stolen in what the firm identifies as the third wave of attacks targeting these devices. The thefts occurred over recent weeks, with the hacker systematically emptying eleven of the largest vaults associated with the campaign. Galaxy Research confirmed the movement of funds through blockchain analysis, noting the coordinated nature of the withdrawals. The stolen assets were transferred to multiple addresses before being consolidated, suggesting an effort to obscure the trail. This latest wave follows two prior incidents where similar vulnerabilities in Coldcard devices were exploited, though the current scale marks a significant escalation.

Security experts have pointed to potential flaws in the recovery phrase handling or firmware verification processes as possible entry points, though Coldcard has not issued an official statement on the specific vulnerability. The company, known for its air-gapped security model, has previously emphasized resistance to remote attacks, making physical or supply-chain compromise a likely vector in these cases.

What Are the Implications for Hardware Wallet Security?

Investigators believe the breach may have stemmed from compromised seed phrases during device initialization or manipulation of the wallet’s backup process. Unlike remote hacks, these attacks likely required physical access or social engineering to obtain recovery seeds before the devices were sealed. Galaxy Research noted that the vaults drained were not newly created but had been holding funds for extended periods, implying the attacker waited for optimal timing. The use of multiple intermediate addresses before consolidation aligns with known laundering tactics aimed at delaying detection. While no direct evidence links this wave to earlier incidents, the similarity in targeting large, long-term holdings suggests a coordinated operation by a sophisticated actor. Coldcard users are advised to verify device integrity and consider re-generating seeds from trusted sources if any suspicion of tampering exists.

The incident raises concerns about the assumed invulnerability of air-gapped devices when human factors are involved. Even the most secure hardware can be compromised if the recovery phrase is exposed during setup or if firmware is altered before distribution. Industry analysts warn that trust in the supply chain and user vigilance during initial configuration are now as critical as the device’s technical design. In response, some experts recommend using multi-signature setups or distributing holdings across different wallet types to reduce single-point failure risks. The event may prompt Coldcard and similar manufacturers to enhance anti-tampering measures and improve user education on secure initialization practices. For now, the movement of such a large sum underscores that no storage method is immune without rigorous procedural safeguards.

Was the Coldcard device itself hacked remotely? No, there is no indication of a remote exploit; the breach likely involved access to recovery phrases before or during device use.

Frequently Asked Questions

Can the stolen Bitcoin be recovered? Recovery is extremely unlikely due to the irreversible nature of Bitcoin transactions and the use of mixing techniques to obscure the trail.

Should Coldcard users stop using their devices? Not necessarily, but users should verify their devices were obtained from trusted sources and consider re-initializing them with new seeds if compromise is suspected.