Coldcard wallets reportedly lost $38M in bitcoin. The setup flaw is now the story.
This is not an exchange hack. It is a wallet safety story, and the affected-version list is still moving.
CryptoVibe Desk · bitcoin · wallets · security
- →Coinkite said some Coldcard wallets may have generated weak seeds after a firmware issue.
- →Reports tied the flaw to 594 BTC stolen from roughly 500 dormant single-signature wallets on July 30.
- →The number to watch is how many old Coldcard users move funds within the next week.
- seed phrase → A seed phrase is the secret backup words that can recreate and spend from a crypto wallet.
- firmware → Firmware is the software that runs directly on a hardware device like a wallet.
- single-signature wallet → A single-signature wallet needs only one key to move funds, so one exposed key can drain it.
Coldcard users reportedly lost 594 BTC on July 30.
Protos and CryptoSlate put the loss near $38 million, from roughly 500 dormant single-signature wallets. Protos reported the drain happened in 25 minutes. It also said 562 BTC remained at the same address.
Coinkite said some Coldcard wallets may have generated weak seeds after a firmware issue. The company's Coldcard account posted an advisory and technical follow-up on July 31. That makes the setup process the issue, not just later storage.
If you're holding old coins on a Coldcard, your bag is now officially version-dependent. Protos and CryptoSlate said Mk3 seeds generated on firmware 4.0.1 or later are at risk. CryptoSlate also reported exposure on Mk4, Mk5, and Q devices before newer firmware, while Protos said Coinkite's early read excluded those models.
That gap matters. The model list is still developing, and users can't act cleanly until Coinkite nails it down. Coinkite and other commentators have also raised AI discovery as a possibility, but the brief does not prove the attacker used AI.
The number to watch is not bitcoin's price. It is how many old Coldcard wallets move funds now that dormant addresses have already been hit.
Coinkite's unclear model list is now part of the security problem: without a signed affected-version checker by Monday, users are guessing with live money.
Before August 7, watch whether Coinkite confirms one final affected model list and whether at least one major wallet researcher reproduces the weak-seed path.
Primary links and supporting reads used by the desk for this story.
Forward this.
