Coldcard Exploit Expands Into a Bitcoin Self-Custody Crisis
The Coldcard seed-generation vulnerability disclosed at the end of July continued to spread through the first days of August, with researchers tracing roughly 1,816 BTC from more than 5,200 compromised addresses. The continuing thefts and reports of Bitcoin moving back toward centralized exchanges transformed the incident from a hardware-wallet exploit into a broader crisis of confidence in self-custody.
The Coldcard hardware-wallet exploit that emerged on July 30 became a substantially larger Bitcoin security crisis during the opening days of August. Researchers initially identified more than 1,000 vulnerable wallets, but successive sweeps continued as attackers exploited weak randomness generated by affected Coldcard firmware. By August 3, researchers estimated that approximately 1,816 BTC had been moved from more than 5,200 addresses across several attack waves, with losses valued at roughly $114 million at the time. Coldcard subsequently urged affected users to move their Bitcoin immediately because vulnerable wallets remained exposed even after the underlying firmware problem had been identified.
The vulnerability was especially damaging because it struck at one of Bitcoin's central security assumptions: that properly generated private keys placed in offline hardware storage are among the safest ways to hold Bitcoin. The problem traced back to poor entropy used in generating some wallet seeds, meaning that an attacker capable of reconstructing or narrowing the possible seed space could discover the private keys without physically obtaining the wallet. Updating the device did not retroactively make an already compromised seed secure. Users therefore had to create new wallets from properly generated seeds and move their coins before an attacker reached them.
The wider historical significance appeared in user behavior. OKX reported record inflows to centralized exchanges following the Coldcard incident, with its chief compliance officer explicitly contrasting the reaction with the aftermath of FTX. FTX's collapse had driven Bitcoin holders toward self-custody; Coldcard was producing evidence of movement in the opposite direction as some users reconsidered whether they trusted themselves and consumer hardware to secure their Bitcoin.
That reversal made August a distinct stage from the July 30 disclosure already preserved in the timeline. July records the discovery of a catastrophic Bitcoin wallet vulnerability. August records the expanding losses and the broader consequence: a security failure serious enough to reopen an old Bitcoin debate over whether sovereignty through self-custody also places risks on individuals that professional custodians can sometimes absorb more effectively. The incident did not invalidate self-custody, but it demonstrated that holding one's own keys is only as secure as the process by which those keys are generated and protected.