The numbers are stark. On July 30, 2025, an automated sweeper cleaned out 1,195 Bitcoin addresses in 41 minutes, moving across nine blocks with surgical precision. The total haul: 1,778.58 BTC, valued at over $115 million. The victims had held their coins for an average of 1,292 days—nearly three and a half years of quiet accumulation, shattered in a single evening.
At first glance, this looks like another exchange hack or a wallet exploit. But the signature of this attack is different. The address cluster belongs to users of Coldcard, a hardware wallet renowned for its security-first design and air-gapped operations. The timing suggests a vulnerability tied to a specific firmware release from March 17, 2021. The attackers did not break into active sessions; they waited. They watched the addresses grow, and then they struck, not with a sledgehammer, but with a key that had been forged in the factory of trust.
This is not a story about a bug. It is a story about the fragility of the entire hardware wallet security model when the foundation—the firmware—is compromised at the source. And it forces us to ask: What does it mean to trust a device that you cannot fully verify?
Context: The Coldcard Legacy and the Attack Timeline
Coldcard, produced by Coinkite, has long been a favorite among Bitcoin maximalists and security-conscious users. Its design philosophy emphasizes isolation: no USB data connection, a secure element for key storage, and open-source firmware that can be compiled by the user. The wallet is marketed as “the most secure Bitcoin hardware wallet,” a claim that relies on the assumption that the firmware is trustworthy and that the entropy source is pure.
The attack began to surface on July 30, 2025, when Galaxy Research data showed a series of sweeping transactions from addresses that had been dormant for years. The attackers used a script that required only a single signature per address, but they batched those transactions into massive outputs: one transaction alone processed 795 addresses. The funds were routed through a script hash vault, a sophisticated move that suggests the attackers had deep knowledge of Bitcoin scripting and UTXO management.
What makes this attack uniquely concerning is the time-bound signature. According to the analysis, the affected keys were generated only after the March 17, 2021 firmware release. This narrows the attack vector to the key generation phase itself. The randomness generator may have been corrupted, or the firmware may have contained a backdoor that allowed the attacker to derive private keys from a known seed. The attack did not happen immediately; it happened after a median wait of 1,292 days, indicating that the attacker either gained access to the keys later or deliberately waited for the addresses to accumulate value.
Core: Technical Analysis of the Key Generation Compromise
Based on my experience auditing smart contracts and examining hardware wallet implementations, I can say that the attack pattern is both elegant and terrifying. The fact that the attacker could sweep 1,195 addresses in 41 minutes implies a precomputed database of private keys. This is not a real-time exploitation; it is a replay attack on a set of keys that were generated with a predictable entropy source.
The most likely scenario is that the firmware’s random number generator (RNG) was seeded with a weak or predictable value. In many hardware wallets, the RNG relies on a combination of hardware noise and firmware entropy. If the firmware update introduced a deterministic seed—perhaps tied to a timestamp, a device serial number, or a shared secret—then every wallet initialized after that update would produce keys that could be derived by anyone who knew the seed.
This is not a new concept. In 2019, researchers demonstrated that a compromised RNG in a Trezor could allow an attacker to generate all future keys. But Coldcard’s reputation made it seem immune to such flaws. The open-source nature of its firmware was supposed to be a safeguard. Yet, as the attack shows, the ability to verify the code does not guarantee that the code is not malicious. The attack may have been a supply-chain compromise, where the firmware binary was altered after compilation, or a subtle change in the random number generation that was not caught by community review.
Code is law, but ethics is soul. The code here was supposed to enforce the law of security. But the soul of the device—the trust that users placed in its creation—was betrayed. The attack reveals that even the most paranoid hardware wallet can be subverted at the most fundamental level: the moment of key generation.
The Attacker’s Operational Discipline
The technical execution of the sweep is a work of art. The attacker used a fixed fee of 30 sat/vB across all transactions, ensuring that the sweep was prioritized by miners without overpaying. The batch processing of 795 addresses in a single transaction shows a deep understanding of Bitcoin’s transaction structure and the ability to construct large multi-input transactions that are still valid. The use of a script hash vault to hold the 207.73 BTC in Wave 3 indicates a desire to delay the final movement of funds, possibly to avoid triggering alarms or to allow for mixing.
This is not a script kiddie. This is an organization with full-time developers, possibly a team of five or more, who spent months preparing the attack. The median wait time of 1,292 days suggests that the attacker either discovered the vulnerability recently and then extracted the keys from a historical database, or they had the keys from the beginning and waited for the addresses to mature. The latter is more chilling: it implies that the attacker could have drained the wallets at any time, but chose to wait until the value was high enough to justify the risk of exposure.
Transparency isn’t the oxygen of trust. The attack shows that transparency—the ability to inspect the code—is not sufficient. The trust must extend to the entire supply chain, including the build process, the distribution of firmware updates, and the integrity of the random number generator. Without verifiable builds and reproducible firmware, users are trusting a black box, even if the source code is open.
Contrarian: The Pragmatic Test of Hardware Wallet Security
Most discussions of the attack focus on the bug itself. But the contrarian perspective is that this attack is not an anomaly; it is a natural consequence of the hardware wallet ecosystem’s failure to adopt rigorous security practices. The industry has been built on a myth: that if the device is air-gapped and the code is open, you are safe. This attack proves that myth is false.
Consider the lifecycle of a hardware wallet. It is manufactured, shipped, updated, and used. Each step is a potential point of failure. The firmware update that introduced the vulnerability was likely signed by Coinkite, but the user has no way to verify that the update binary matches the source code unless they compile it themselves. And even then, the compilation environment could be compromised. The attack demonstrates that the entire chain of trust must be verifiable, not just the final product.
Furthermore, the attack targets the key generation phase, which is often the least scrutinized part of the security model. Hardware wallets are designed to protect keys after they are generated, but they assume that the generation process is secure. This assumption is naive. The attack shows that the generation phase is the most vulnerable, because it is the point where hardware, firmware, and randomness converge.
Another blind spot is the response time. The attack was discovered on July 30, 2025, but the funds were generated over three years earlier. The community has no way to know how many other wallets are affected. The attacker may have a database of millions of private keys, waiting to be used. The current loss of 1,778.58 BTC may be just the tip of the iceberg. The attacker may be testing the waters, or they may have already sold the keys to other criminal groups.
The Moral Responsibility of the Manufacturer
Coinkite has a responsibility to disclose the full details of the vulnerability. So far, the analysis suggests a firmware issue, but the company has not confirmed the root cause. This lack of transparency is alarming. Users who bought Coldcard after March 2021 are now facing a potential existential risk. They cannot know if their keys are compromised unless they move their funds to a new wallet generated with a different device.
But the moral responsibility extends beyond the manufacturer. The Bitcoin community has long promoted hardware wallets as the gold standard for self-custody. This attack undermines that trust. It calls for a re-evaluation of the security model. Perhaps the solution is not to trust single hardware devices, but to use multi-signature wallets that require keys from multiple independent sources. Or perhaps the solution is to verify the entropy of the key generation process using a combination of hardware and software randomness.
Takeaway: The Future of Trust in a Trustless System
The attack on Coldcard is a wake-up call. It reminds us that the blockchain is only as secure as the tools we use to interact with it. The ideology of “don’t trust, verify” must be applied not just to the network, but to every layer of the stack. We need verifiable builds, reproducible firmware, and hardware that can attest to the integrity of its randomness.
Based on my experience with the Aave V2 audit and the Verifiable Humanity initiative, I know that the line between code and ethics is thin. The attack on Coldcard is not just a technical failure; it is a moral failure of the ecosystem to enforce real security. The victims did nothing wrong. They followed best practices. They used a trusted device. And they were betrayed.
Guard the commons, or lose the future. The commons here is the trust in self-custody. If we lose that trust, we lose the very foundation of Bitcoin. The attack must be a catalyst for change. We must demand that hardware wallet manufacturers prove their integrity, not just claim it. We must build systems that are resilient to compromise, not just resistant to it.
The attack is over, but the long tail of consequences is just beginning. The 1,778.58 BTC that were stolen are a tragedy. But the real tragedy would be if we continue to trust devices that we cannot fully verify, and if we ignore the lesson that even the most secure hardware can be turned into a weapon against its owner.