Fake Sparrow App Drains 7.40 BTC From Coldcard Wallet
A Bitcoin holder lost 7.40 BTC after entering a seed phrase into a fraudulent mobile application impersonating Sparrow Wallet. The incident, later documented in federal-court filings, illustrated how social engineering and software impersonation could defeat otherwise strong self-custody hardware.
On July 25, 2025, a Bitcoin holder lost 7.40 BTC after interacting with a fraudulent mobile application presented as 'Sparrow Multi-Sig.' According to later federal-court filings, the app used Sparrow Wallet branding and induced the victim to enter a seed phrase associated with bitcoin secured through a Coldcard hardware wallet. Once the seed phrase was exposed, the bitcoin could be controlled by whoever possessed it, and the wallet was drained.
The mechanics of the incident are important because they show the distinction between hardware-wallet security and seed-phrase security. A hardware wallet such as Coldcard is designed to keep private keys isolated from an ordinary computer or phone, but the recovery seed represents the underlying secret from which wallet keys can be reconstructed. Entering that seed into malicious software bypasses the protections of the hardware device because the attacker no longer needs physical access to it.
The theft was a security and human-interest episode rather than evidence of a flaw in Sparrow Wallet or Coldcard themselves. The historical lesson was that Bitcoin self-custody risk does not end with choosing strong hardware. By 2025, attackers increasingly relied on impersonation, malicious applications, and social engineering to persuade users to surrender the credentials that self-custody systems are designed to protect.