COLDCARD Seed-Generation Flaw Tied to Major Bitcoin Theft

Was COLDCARD itself remotely hacked?

No. Coinkite says a firmware bug weakened seed generation, allowing attackers to regenerate private keys offline without remotely accessing or taking over the devices.

Orbitrum Investor Impact

How much Bitcoin was stolen?

Galaxy Research confirmed 1,778.84 BTC, worth $112.7 million at the time, from more than 8,600 addresses with high confidence. Including lower-confidence candidate activity would raise its estimate to 2,417.35 BTC, so TokenPost's later 1,830 BTC figure should not be treated as a definitive total.

Why does the incident matter for COLDCARD's business?

The failure affects the core security function of the hardware wallet and requires customer migrations, firmware remediation, and trust rebuilding. The reviewed sources do not quantify Coinkite's resulting revenue impact, compensation costs, or legal exposure.

Is current COLDCARD firmware patched?

Yes. Coinkite lists Mk4/Mk5 5.6.2 and Q 1.5.2Q as its current recommended standard releases, with fixed releases also available for affected legacy and Edge models.

Does updating the firmware make an existing affected wallet safe?

No. Updating fixes future seed generation but does not repair an affected seed that already exists; users must migrate funds to a newly generated seed unless the advisory's independent-dice exception applies.

What remains unresolved?

The final theft total and attacker attribution remain unsettled, although Galaxy reported no confirmed new attacker activity after August 6. Coinkite's security record also says a separate detailed technical postmortem remains in preparation.