Coldcard Seed Generation Flaw Allegedly Drains Nearly $38M in BTC From 500 Dormant Wallets

A suspected seed-phrase generation exploit tied to Coldcard hardware wallets drained nearly 600 BTC—about $38 million—from roughly 500 dormant wallets yesterday. On-chain activity shows bitcoin moving from 500 single-signature addresses into a single address in about 25 minutes. Reports circulating in the market suggest the exploit may still be active. Coinkite said seed generation on its Mk3 wallet, as well as updated versions beyond the March 2021 v4.0.1 release, may not have been random. Coldcard initially stated that, based on early analysis, Mk3 devices were at risk, while Mk4, Q, and Mk5 were not. The Block later attributed the issue to a miswritten compile-time check and said it identified a smaller but real instance of the same flaw affecting newer devices. Why it matters: Exploits involving hardware wallets can undermine confidence in self-custody. Uncertainty around the scope of the vulnerability could prompt users to move funds preemptively. Market sentiment: Bearish, stress-on, event-driven, de-risking. Driver: The reported $38 million theft from dormant Coldcard wallets may weaken perceptions of self-custody security. Comparable case: In 2022, Solana ecosystem teams linked a wallet-draining event to Slope, impacting nearly 8,000 wallets. Slope advised users to generate new seed-phrase wallets and migrate funds. The key difference: the Slope incident stemmed from software wallet exposure, while the Coldcard issue centers on hardware wallet seed generation. Ripple effects: The main transmission channel is trust in self-custody. Weak seed generation can convert dormant wallets into active loss risk. If continued exploitation is confirmed, affected users may rush to migrate funds and custody tools could face heightened scrutiny. If newer devices fall within scope, concern could extend beyond Mk3 users. Opportunities and risks: Opportunities: If Coinkite or The Block narrows the affected firmware set, limiting fund migrations to devices within that scope can reduce operational risk. If exploit activity stops after remediation details are published, confidence in unaffected devices may stabilize. Risks: If further drains occur via the same weakness, reducing reliance on affected hardware wallets becomes a practical risk-control step. If newer devices remain within scope, delaying seed rotation could leave wallets exposed to ongoing compromise.