Coldcard Firmware Flaw Tied to Movement of 1,000+ BTC, Roughly $70M

Galaxy Research said Friday that more than 1,000 BTC from nearly 1,200 addresses has been moved, worth about $70 million, in transactions it believes are linked to a vulnerability affecting Coldcard hardware wallets. Coinkite issued an alert Thursday about an ongoing problem involving seed phrases generated by Coldcard Mk3 devices. The company said users who created seed phrases on Mk3 units running firmware version 4.0.1—released in March 2021—or later may have funds at risk. Coinkite later broadened the warning to certain firmware versions across Mk4, Mk5, and Coldcard Q, and pushed emergency firmware updates for all impacted models. Coinkite CEO Rodolfo Novak, known as NVK, apologized Friday and said the firm takes full responsibility for the firmware vulnerability. Why it matters: Firmware flaws that affect seed generation can undermine confidence in self-custody by creating a direct pathway to loss. Market sentiment: Bearish; stress-on; event-driven; fear. The reported movement of more than 1,000 BTC tied to a Coldcard issue raises immediate custody-risk concerns for Bitcoin holders. Similar past case: In June 2023, Atomic Wallet users lost more than $35 million in crypto following a major compromise, pushing sentiment toward security audits and fund-tracking efforts (Fortune). Atomic Wallet centered on a software wallet service, while this incident focuses on hardware-wallet firmware and seed phrase generation. Ripple effect: If seed generation is weakened, self-custody can become a correlated loss channel for users who relied on the same firmware. Additional affected firmware versions or further linked BTC movements could trigger broader risk repricing across the hardware-wallet market. Opportunities and risks: - Opportunities: If emergency firmware updates slow or stop additional linked movements, the incident may remain contained and users can focus on confirmed guidance for affected devices. - Risks: If Coinkite expands the scope again, reducing exposure to affected wallets and moving funds to verified safe storage could help limit operational risk.