⚠️ Coldcard users lose millions due to 2021 firmware flaw One of the most significant incidents in Bitcoin self-custody security delivered a crucial lesson: the protection of a hardware wallet depends primarily on the security with which seeds are generated. A vulnerability tied to Coldcard firmware versions released in 2021 allowed attackers to drain hundreds of wallets without physical access to the devices, without phishing, and without malware. Reports estimate that between 594 Bitcoin-native addresses and over 1,082 BTC may have been stolen—equivalent to approximately $38 million to $70 million. The attack occurred within a narrow window of 25 to 40 minutes and affected wallets whose seeds were generated during the vulnerable period. Many of the compromised addresses had remained inactive for years, with funds stored since the seeds’ creation. On-chain analysis suggests the attacker first targeted wallets with the highest balances, including one containing approximately $1.8 million. The attacker then expanded the drain using an automated process that swept additional vulnerable addresses, indicating prior identification of affected wallets. The technical cause was insufficient entropy during seed generation on certain Coldcard models, particularly affected Mk3 devices. Instead of properly utilizing hardware randomness, the process could generate predictable seeds, enabling remote reconstruction of private keys. Coinkite advised potentially affected users to migrate their funds to new wallets created with updated firmware. The incident reinforces a fundamental security principle: if seed generation fails, even advanced protections such as air-gapped design and secure hardware lose much of their effectiveness.