Coldcard Losses Near $114M as Small Bitcoin Transfers Spike

A Coldcard hardware wallet has been generating guessable keys since a March 2021 firmware build error — and five years later, attackers are sweeping the wallets it protected. Losses are approaching $114M, and small Bitcoin holders are moving coins at a pace not seen since FTX collapsed. This is what a silent, dormant crypto flaw looks like when it finally goes loud.

The story

On July 31, 2026, small Bitcoin holders moved coins at a rate the market hadn't seen since the days after FTX failed. Transfers of less than 1 BTC totaled 39,600 BTC — roughly $2.5 billion — according to CryptoQuant, a figure that nearly matches the 39,900 BTC moved on November 16, 2022, in FTX's immediate aftermath. Daily active addresses jumped from 645,000 to almost a million, the highest since December 2024, and the surge concentrated in *sending* addresses, not receiving ones. People were moving to protect, not to sell — Bitcoin's price barely twitched even as sub-10 BTC exchange deposits hit 7,300 BTC ($459 million), the most since February.

The trigger: news had spread that Coldcard hardware wallets had been generating guessable seed phrases for five years. The flaw traces to a March 2021 firmware build error that drew seeds from far too small an entropy pool. Galaxy Research logged three waves of thefts by Saturday — 1,367 BTC across 4,585 addresses — and flagged a likely fourth wave in progress. Galaxy's Alex Thorn identified sweeps across 15 consecutive blocks running at roughly 45 times the normal rate; after correcting for wrongly-included multisig addresses, he put the fourth wave at 709 addresses and 448.73 BTC ($28 million), pushing the running total toward 1,816 BTC — near $114M. Thorne caveat matters: no victim has yet confirmed the fourth wave, which rests on pattern matching.

The one hopeful detail: some sweeps sat unconfirmed in the mempool with replace-by-fee opted in, meaning holders who moved fast and paid a high enough fee could outbid the attacker and rescue their own coins.

The context

This is not a phishing campaign or a supply-chain compromise. It's a latent cryptographic defect that sat dormant for five years and became exploitable the moment enough people understood it. The loss figure has climbed in visible steps as awareness spread — about $38 million when the flaw was disclosed, $70 million when Changpeng Zhao warned holders, and now near $114 million as the fourth wave runs. That trajectory is the tell: the vulnerability was always there; what changed was exploitability.

Kraken CSO Nick Percoco called it "a wake-up call for the entire hardware wallet industry" — and named the precise failure mode. Coldcard's Mk4, Mk5 and Q ship with *certified* secure elements, yet their seeds still came out around 72 bits, because the certification covered the component while nobody verified which code path actually ran. The certificate was real. The thing it certified wasn't the thing running.

What it actually means

This maps cleanly onto how UL frames real risk: exposure plus exploitability drive it, not latent defects alone []. The Coldcard seeds were mathematically weak for five years — pure latent risk — but the danger only surfaced when the flaw became public and attackers could act on it. The Vuln Equation UL uses puts it exactly this way: Surfaced = Latent × I/(I+E) []. Disclosure didn't create the vulnerability; it collapsed the term that had been holding it dormant.

The deeper lesson is about where trust actually lives. A certified secure element told buyers "this is safe." But certification of a component is not verification of the running system. The entropy came from a code path nobody validated against the certificate. That's a gap between what was attested and what was true — and it's the same gap UL's whole approach to authoritative claims is built to close: trust should come from verification of the actual thing, not from a marker attached to it []. Take the position plainly: a certificate that doesn't bind to the specific firmware and the specific code path is theater.

Percoco's proposed fix is the right one — independent lab validation of entropy sources, bound to specific firmware versions and listed in a public registry, the way payment terminals already require. Coinkite's hotfix now fails the build unless the correct generator is linked in, a control that took about 48 hours to write once they knew what to look for. Forty-eight hours, against five years of exposure. The hard part was never the code.

Implications

• Certification is not verification. Security teams relying on component certifications — secure elements, HSMs, certified crypto modules — should treat the certificate as a claim about a part, not a guarantee about the system that ships it. Ask which code path runs, and whether anyone verified it end to end.
• Latent flaws have a detonation moment. The window between disclosure and mass exploitation is short and hostile — three-to-four theft waves inside days here. Incident response for cryptographic defects has to assume attackers move at machine speed the moment a flaw is public.
• Provenance registries are coming. Percoco's call for entropy validation bound to firmware versions in a public registry echoes a broader industry direction: verifiable, version-pinned attestation of what actually runs. Expect regulatory and buyer pressure in this direction across security hardware.
• The build pipeline is a security control. Coinkite's fix — fail the build unless the correct generator is linked — is a reminder that supply-chain and build-time guardrails catch the class of error that human review missed for five years.

Takeaways

• If you hold a Coldcard, assume your seed may be weak; move funds now, and if you're mid-sweep, use replace-by-fee to outbid the attacker.
• A certified component does not certify the system — always verify which code path actually runs.
• Latent cryptographic flaws are exposure waiting for a trigger