Coldcard Hardware Wallet Vulnerability Leads to Nearly 2000 BTC Theft

Compiled & Organized by Shenchao TechFlow

Moderator: Austin Campbell (Host, Zero Knowledge Group), Ram Ahluwalia (CEO, Lumida Wealth), Chris Perkins (Franklin Crypto)

Guest: Alex Thorn, currently Managing Director and Head of Firmwide Research at Galaxy Digital, previously spent 12 years at Fidelity Investments and is known as the "Bitcoin Viking."

Key issues: Coldcard hardware wallet vulnerability, four-wave on-chain attack tracking, AI security safeguards backfiring against defenders, the boundary between self-custody and institutional custody, Federal Reserve interest rate environment

Program Name: Unchained · Bits + Bips · The Coldcard Hack with Galaxy’s Alex Thorn

Disclosure: Alex Thorn is employed by Galaxy Digital, a company that provides institutional-grade crypto asset custody, trading, asset management, and ETF-related services; Chris Perkins works at Franklin Crypto, a division of Franklin Templeton, and is involved in crypto ETF and related businesses; Ram Ahluwalia is CEO of Lumida Wealth, which offers crypto asset management services. This episode’s discussion on self-custody versus institutional custody involves perspectives that may be influenced by the guests’ affiliations and their organizations’ commercial interests.

• In its firmware update on March 17, 2021, Coldcard introduced a new random number generator (RNG), but a wiring error caused it to never be actually called, resulting in the system silently falling back to a pseudo-random number generator with extremely weak entropy.
• Attackers can exploit this vulnerability to batch-calculate possible private and public keys, thereby draining funds from affected single-sig addresses. The issue is not with the Bitcoin protocol itself, but with the underlying cryptographic implementation.
• Alex Thorn estimated on the show that the first three waves of attacks resulted in approximately 1,400 BTC in losses; including the fourth wave, which is still being confirmed, the total scale approaches 2,000 BTC, or over $100 million—an unprecedented scale for vulnerabilities in decentralized self-custody hardware wallets.
• Most victims were long-term holders with an average coin age of nearly four years. They did not click on phishing links or leak their seed phrases—they simply trusted the hardware wallet’s random number generation.
• Since the stolen funds were spread across thousands of unrelated cold storage addresses, on-chain tracking is significantly more challenging than in the case of a DeFi bridge hack. Alex has submitted approximately 600 suspicious addresses to U.S. federal law enforcement agencies, exchanges, and on-chain analysis firms such as Chainalysis, TRM Labs, and Elliptic.
• U.S. frontier AI models refused to assist in tracking and auditing code due to security safeguards, forcing the red team to use Chinese open-source models such as Kimi and GLM for defense analysis.
• Events are driving Bitcoin from self-custody toward exchanges and ETFs. Alex believes that multisig collaborative custody solutions (such as Casa and Unchained) remain secure self-custody options, but for the average person, regulated intermediaries like Coinbase, Bitkey, and ETFs may be more practical choices.
• Host Chris Perkins emphasized that the only free lunch in finance is diversification. Don't put all your Bitcoin into a single wallet or a single ETF.

If you still have your coins in a single-signature address on your Coldcard, please move them as soon as possible.

These people did nothing wrong. They did everything right. They are not DeFi yield farmers or meme coin speculators—they are simply hardworking individuals who saved Bitcoin and stored it in cold wallets.

This isn't a Bitcoin issue; it's a cryptography issue. If your email provider used the same random number generator, your emails could be cracked too.

The leading AI models in the U.S. refused to help us track these stolen funds, so our red team had to resort to open-source models from China. This is absurd.

I won’t get off the self-custody train. But if your mom or dad asks you how to store Bitcoin, I might tell them to open a Coinbase account.

The hedge fund industry is both the most captivating and the most grueling. You think you’re the master of the universe, but you’re actually waking up at 3 a.m. to check South Korean stock prices, then again at 6 a.m. to see what’s happened in the world.

I. Market Snapshot: BTC Holds at $63,000; AI Fund Situational Awareness Loses $35 Billion in One Month

At the start of the show, Austin Campbell presents a market snapshot: Bitcoin is trading around $63,000 for the day, Ethereum around $1,850, and the 10-year U.S. Treasury yield remains elevated at 4.72% to 4.75%, with the market pricing in over a 50% chance of a hawkish stance from the Federal Reserve.

The day's biggest story was the collapse of the Situational Awareness fund, whose assets under management (AUM) plummeted from approximately $45 billion to around $10 billion, erasing roughly $35 billion in a single month—a 67% decline. Margin calls from prime brokers forced the fund to sell its publicly traded stock portfolio at distressed prices to Ken Griffin’s Citadel, leaving its remaining assets primarily as private equity stakes and private instruments in Anthropic.

Ram Ahluwalia believes this is not a Citadel conspiracy. “After Micron’s earnings report, the stock dropped double digits—just like last quarter. Momentum trading was pushed to three standard deviations, then collapsed.” He compares Leopold to the previously liquidated Asymmetric Fund (long Solana, short ETH), calling it “essentially the same leveraged bet.” Ram also notes that Leopold is only 24, and his fiancée is the chief of staff to Anthropic’s CEO—“too close to the circle to see beyond the AI bubble.” He estimates that much of the new capital was invested at recent highs, and Citadel absorbed the liquidated positions at distressed prices—“these investors likely lost their entire principal.”

Alex Thorn was asked about the fundamentals of AI infrastructure and data centers. He characterized the recent sell-off as “80% technical, 20% fundamental,” noting that “during the rally, situational awareness and one’s own position may have been among the primary drivers.” However, he emphasized that the four major hyperscale cloud providers continue to forecast substantial capital expenditure growth, and demand for AI-related cybersecurity and computing power remains far from satisfied. “It’s a bit like the dot-com bubble, and a bit like Bitcoin in 2017. Back then, many said it was the top—but today, Bitcoin is more than three times higher than its 2017 peak.”

Chris Perkins adds from a risk management perspective: “In a young market with leverage, volatility amplifies in both directions. You might be right about the direction, but if your position size and risk controls are wrong, the outcome is still zero.” He also noted that Citadel, Jane Street, and Millennium now serve as “lenders of last resort”—“The era when regulators and investment banks gathered everyone at the New York Fed to raise funds, as with LTCM, is over; now, you just make a single call to Citadel.”

II. Coldcard Vulnerability: A Misconfigured Random Number Generator Turns Single-Signature Addresses into ATMs

Before diving into the Coldcard topic, Alex Thorn issued an urgent recommendation: "If you still have your coins stored in a single-signature address on your Coldcard, move them immediately."

Austin Campbell summarized the event in one sentence: Coldcard, long regarded as the "gold standard" among Bitcoin hardware wallets, has had its Mark III, Mark IV, and Mark V users' Bitcoin drained en masse due to an entropy-related vulnerability, with over a thousand affected addresses and losses continuing to rise.

Alex explained that generating cryptographic keys requires a random number generator to provide sufficient entropy. The weaker the entropy, the more easily the key can be brute-forced. Coldcard added its own random number generator in a firmware update on March 17, 2021, but a coding error caused it to never actually be invoked. The system silently failed and fell back to a pseudo-random number generator with extremely weak entropy.

Once attackers know this, they only need computational power to batch-generate candidate private and public keys, then scan the entire derivation path for addresses with balances. Once a match is found, they initiate a transaction to transfer the funds.

Alex emphasized that the cruelty of these attacks lies in the fact that victims made no mistakes: “They didn’t leak their seed phrases, didn’t click on phishing links, and didn’t send their private keys to group chats. They simply worked hard, consistently saved Bitcoin, and stored it in cold wallets. These people did nothing wrong—they did everything right.” He noted that the average dormancy period of the stolen coins was nearly four years, indicating that the victims were mostly long-term holders.

Chris Perkins added that this is fundamentally a cryptographic implementation issue, not a problem with Bitcoin, Ethereum, or any blockchain protocol. "If an email service uses the same random number generator, your encrypted emails can also be cracked."

Alex also noted that the vulnerability remaining undetected for five years may be related to codebase governance: “It’s not fully open source, and there are many unannotated commits on the main branch.” He also acknowledged that AI may have accelerated the discovery of the vulnerability, but “it could have been found without AI—the issue is that not enough eyes were reviewing this code.”

Third and Fourth Wave Attacks and On-Chain Tracking: The "Silent Theft" of Thousands of Cold Wallet Addresses

Alex revealed that over the past few days, he has been conducting on-chain tracking to identify victim and attacker addresses, and has submitted these addresses to U.S. federal law enforcement agencies, major exchanges, and analytics firms such as Chainalysis, TRM Labs, and Elliptic—“so there’s still a chance to recover the funds if they enter centralized intermediaries.”

He categorized the known attacks into four waves, but the fourth wave has not yet been fully confirmed:

• First and second waves: Large amounts of victims' coins were aggregated into one or two collector addresses, then transferred to one or two attacker-controlled addresses. The structure was similar, and Alex suspected they were carried out by the same group. These two waves accounted for over 70% of the total loss.
• Third wave: The structure is completely different. The attacker sets up a separate vault for each victim: “If your 10 addresses are swept, they are first aggregated into a single intermediate address belonging solely to you, then moved into a vault belonging solely to you.” Alex estimates that the third wave involves approximately 293 victims and 293 vaults.
• Wave 4: Alex solely identified via burst pattern; approximately 389 BTC have been swept from 462 suspected victim addresses in about 2.5 hours through 208 transactions, but no victims have come forward to confirm yet.

In addition to these four waves, Alex identified at least 14 other recognizable attack patterns, which he temporarily labeled as Footprint A through L. Victims of these patterns have already reported the incidents individually, but each case is relatively small in scale and has not yet allowed for an extrapolation of the total number.

Alex's latest estimate on the show was: by the end of the third wave, losses approached 1,400 BTC; if the fourth wave is confirmed, the total could approach 2,000 BTC; even without counting the fourth wave, it would still be around 1,600 BTC. “For a distributed self-custody storage vulnerability, this is the largest I’ve ever seen.”

The challenge in on-chain tracking lies in the fact that these addresses were originally unrelated. “If a DeFi bridge had been hacked, we would only need to monitor the smart contract address to see where the funds flowed. But here, each address is a user’s cold storage address, so we must rely on the attacker’s transaction fingerprints, victim reports, and behavioral patterns such as fee overpayment to reverse-engineer the connections.”

IV. AI Safety Safeguards Backfire: U.S. Models Refuse to Assist, Defenders Turn to Chinese Open-Source Models

Austin Campbell shifted the topic to AI and security: “In this cat-and-mouse game, does AI ultimately help attackers or defenders?”

Alex Thorn’s response was surprising: defenders were blocked by the safety guardrails of U.S. AI models. “Red teams auditing all hardware wallet codebases have been forced to use Chinese open-source models like Kimi and GLM, because U.S. frontier models simply do not permit this kind of cybersecurity analysis.”

He gave an example using his own toolchain: "I have a complete Bitcoin analysis system locally—a 37-billion-line, 1.7 TB PostgreSQL database that records every transaction and state change in Bitcoin's history. When I ask Claude Fable 5 to query some of this local data, I get denied by a security card half the time. These are my own machine's data—I haven't even visited a website."

Chris Perkins believes that, at the policy level, the boundary between "defenders" and "attackers" needs to be redrawn. "We should allow white hats to take proactive action, just as the early Constitution permitted privateers. This is no different from a burglar breaking into your home or your car being stolen—it shouldn’t be accepted as normal loss simply because it happens in the crypto world."

Ram Ahluwalia analyzed from a broader historical perspective on technology: “Most technologies favor the attacker. Stuxnet, aircraft, cyberweapons—history repeatedly shows that defense is too broad, while attackers only need to find one vulnerability.” He noted that the United States currently has no competitive open-source model: “This is a public goods problem, like a park—everyone benefits, but no one has the incentive to individually fund its maintenance. China, by contrast, has adopted a different strategy because it needs to catch up in hardware and original R&D. I believe the Department of Defense and DARPA should seriously consider funding an open-weights model.”

Austin mentioned that the founder of Hugging Face said on a political program, “In the long term, AI will be DeFi’s largest asset—we just need to get past this hurdle.” Alex agreed with this assessment: “Once these security issues are resolved, they’re resolved. AI will ultimately be very helpful for security.”

Five: Self-custody vs. Institutional Custody: How Should Regular Users Choose?

Austin Campbell admits he doesn’t have a standard answer either: “If my mom, dad, or a friend asked me how to store Bitcoin, I wouldn’t know what to say.”

Alex Thorn believes that most losses of self-custodied funds actually stem from phishing attacks or user error. “In the past, the question was always: Would you have your grandmother use a hardware wallet, or would you have her open an account on Coinbase? I genuinely believe that for most ordinary people, Coinbase or Bitkey is more appropriate.” He specifically noted that Bitkey is the first hardware wallet he’s willing to recommend to his older family members.

But he also emphasized that multi-signature collaborative custody solutions for Bitcoin—such as Casa, Unchained, Unchuck, Leona Wallet, and AnkerWatch—remain very secure, as they distribute private keys across multiple hardware wallets and custodians, eliminating single points of failure. He said he won’t leave the self-custody train: “I’m like Jordan Belfort saying, we’re not effing leaving.”

However, the reality is that the event has triggered a reversal of funds from self-custody back to exchanges and ETFs. Alex cites data from Timechain Index and CryptoQuant: since last Friday, approximately 22,000 bitcoins have flowed back into exchanges, with the volume of small transfers (<1 BTC) entering exchanges reaching a multi-year high. “This is a reverse flow since FTX. People are moving away from self-custody and flocking to exchanges.”

Alex is tolerant of this phenomenon: “Some Bitcoin purists look down on people who use ETFs, thinking they aren’t real Bitcoiners. But it’s their money. If you don’t have the education or training needed for self-custody, that’s okay.” He himself holds Bitcoin through various methods, including River, Fidelity Digital Assets, and ETFs.

Chris Perkins took over, emphasizing that "the only free lunch in finance is diversification." He cited the news that NBA star Giannis Antetokounmpo spread his cash across 50 banks, noting, "Greece has unique memories of banking crises, and the Cyprus haircut was also one of the reasons the Winklevoss brothers initially favored Bitcoin. Don't put all your Bitcoin in one place—whether it's a self-custody wallet or an ETF."

Ram Ahluwalia added the institutional investor’s perspective: “Institutions fundamentally want someone to sue. They don’t need to control their own private keys—they need a well-capitalized counterparty that can be held legally accountable.” Alex also noted that he has consistently recommended qualified institutional custodians to high-net-worth clients, family offices, and funds: “Now, most major U.S. Bitcoin ETFs use multiple custodians, precisely for the same diversification logic.”

Six: The Federal Reserve and Interest Rates: An Environment Without the "Fed Put"

At the end of the show, Austin Campbell shifted the topic to the Federal Reserve. The FOMC kept interest rates unchanged at 3.50% to 3.75%, with a voting result of 9 to 3, as three officials, including Kashkari, voted against. Kashkari publicly stated that investments in data centers have introduced new demand-side pressures on inflation, and he would prefer to make a modest tightening until more data is available.

Alex Thorn believes the Federal Reserve is letting the market do part of its work. “There’s no more Fed put—that’s the market consensus.” He declined to predict Bitcoin’s price for this year at the end of last year, saying, “At the time, I said the investment environment was highly uncertain, and it now appears that assessment was correct.”

He also noted that the U.S. Treasury appears to want to lower interest rates, with power shifting from the Federal Reserve to the Treasury. Meanwhile, yen carry trades have not yet been fully unwound: “Scott Bessent is buying yen and selling euros, while Trump on Air Force One said we love the Japanese—except for Pearl Harbor. In this environment, the direction of interest rates is extremely difficult to predict.”

Ram Ahluwalia believes that Kevin Warsh’s criticism of the Fed’s accountability has merit: “It is true that U.S. inflation has been above 2% for five consecutive years. However, long-term yields have already been rising on their own, and the Fed’s forward guidance may be supplanted by market-generated reaction functions.”

Chris Perkins concluded: “We need better policy responses. Theft in the cryptocurrency space is still theft—it cannot be tolerated just because it happens on-chain.”