⚠️ Coldcard users lose millions after 2021 firmware flaw One of the most significant self-custody security incidents involving Bitcoin has exposed a critical lesson: hardware wallets depend on the security of the seed generation process above all else. A Coldcard vulnerability linked to firmware versions released in 2021 allowed attackers to drain hundreds of wallets without physical access, phishing or malware. Reports estimate that between 594 BTC and more than 1,082 bitcoin:native may have been stolen, representing roughly $38 million to $70 million in potential losses. The attack unfolded within a short window of around 25 to 40 minutes, targeting wallets whose seeds had been generated during the vulnerable firmware period. Many affected addresses had remained inactive for years, with funds stored since the time the compromised seeds were created. According to on-chain analysis, the attacker appeared to prioritize high-value wallets first, including one holding approximately $1.8 million. The operation then expanded into an automated sweep of additional vulnerable addresses, suggesting prior identification of affected wallets. The root cause was linked to insufficient entropy during seed generation on certain Coldcard models, particularly Mk3 devices using affected firmware versions. Instead of relying correctly on hardware-based randomness, the process could produce predictable seeds that allowed private keys to be reconstructed remotely. Coinkite advised potentially affected users to migrate funds to new wallets generated with updated firmware. The incident reinforces a fundamental security principle: if seed generation fails, even strong protections such as air-gapped design and secure hardware cannot fully protect user funds.