- Published on
Coldcard urges users to move bitcoin as active wallet exploit continues
- Authors
- Name
- DeepHorus
Coldcard wallet developers issued an urgent warning Tuesday telling users to move their bitcoin immediately as an active exploit continues to drain funds from self-custodied wallets. The vulnerability has already siphoned as much as $114 million from affected devices, with the attack still underway. The firm urged holders to treat the warning as urgent and migrate funds without delay.
The flaw, which has sat dormant in firmware since 2021, allows attackers to guess poorly randomized seed keys and drain wallets without physical access to the device. It affects specific Coldcard models: Mk3 devices set up on firmware 4.0.1 or later, and Mk4, Mk5 and Q devices running older firmware. Wallets created using the device's dice-roll option remain safe, as they bypass the broken code.
CoinDesk reported Monday that a possible fourth wave of sweeps occurred throughout the day, taking roughly 449 bitcoin from 709 addresses. That raised cumulative losses from about $89 million to as much as $114 million. The threat is active and requires manual intervention by each user to fix.
Coldcard's parent company Coinkite said users should update firmware, generate a new seed, and carefully move funds to a new wallet. The company specifically asked the community to warn holders who are "less online" and may not have seen the alert, as they remain the most exposed. A seed is the master key controlling a wallet's coins; if generated with too little randomness, it can be guessed and regenerated by an attacker.
Vincent Bouzon, a cybersecurity expert at Ledger, a competing hardware wallet maker, said the incident reflects a failure of one implementation rather than a condemnation of self-custody. He emphasized that every wallet depends on a root secret generated from high-quality entropy, which must be anchored in secure hardware. He argued that software wallets on non-secure hardware are riskier, and centralized exchanges offer only an IOU, not true ownership.
Despite the dramatic warning, bitcoin's price remained stable, trading near $63,800 in early U.S. hours Tuesday. The exploit highlights ongoing risks in the hardware wallet ecosystem, even as bitcoin adoption grows. Users affected by the advisory must act quickly to secure their funds before further waves of sweeps occur.
