Home›Crypto›Market Structure›Coldcard exploit steals nearly 600 bitcoin, highlighti…

Coldcard exploit steals nearly 600 bitcoin, highlighting self-custody risks

Coinkite says updating Coldcard firmware does not protect seed phrases generated on vulnerable versions, requiring affected users to create new wallets and move funds.

Reported · Written up by our desk · Market Structure

CoinDesk reports that a software flaw in Coinkite’s Coldcard hardware wallet has led to the theft of at least $38 million worth of bitcoin, with attackers able to recreate wallet recovery phrases and drain nearly 600 bitcoin so far. The incident is being described as one of the biggest self-custody failures to date, despite a subsequent patch to the affected firmware.

According to CoinDesk, Coinkite CEO NVK said in an open letter that users with seed phrases generated using vulnerable Coldcard firmware need to generate entirely new wallets and move their funds. The outlet notes that updating the device firmware alone does not eliminate the risk for seeds already created.

Security experts cited by CoinDesk said the hack points to rising operational risks as cyber threats evolve, even when users are aiming for “proper” self-custody practices. Some industry observers also suggest the episode could push more investors toward regulated custodians and spot bitcoin ETFs.

CoinDesk also highlights that prominent bitcoin advocates view the event as damaging because it involves compromised private keys rather than an exchange account takeover. Bitcoin commentator Guy Swann is quoted by the outlet saying the harm involved thousands of individuals having their recovery capabilities effectively recreated, shifting self-custody risk into a different form for everyday holders.

Latest closeBitcoin $62,929.67 ▼2.8%

More like this

Sources