NextFin News - Coldcard users are being urged to move bitcoin from potentially vulnerable wallets even after emergency firmware patches, as confirmed losses tied to a seed-generation flaw rose to 1,596 BTC, or more than $100 million, across about 7,300 addresses. The central tension is that the fix is available, but it cannot repair a recovery seed already created under the flawed process. A suspected fourth attack wave could lift the total to 2,055 BTC, or roughly $130 million, but that upper estimate remains unconfirmed.
Galaxy Research said three major attack waves and 14 smaller incidents account for the confirmed tally. About 90% of the stolen bitcoin had not moved as of the latest update, leaving investigators with a traceable on-chain footprint but users with little assurance that the threat has ended. The firm said 73 victims had contacted its researchers and that attacker and victim addresses had been shared with U.S. federal law enforcement, exchanges and cyber-investigation firms.
Bitcoin itself remained liquid rather than disorderly. An intraday market-data snapshot on Aug. 4 placed BTC near $63,700, with other contemporaneous readings in the low-$63,000s. That relative price stability matters: the incident is a failure of wallet security and key generation, not a compromise of Bitcoin's consensus rules. Yet the lack of a network-wide selloff does not make the event small. It shifts the risk from protocol confidence to the institutions, devices and procedures that turn a cryptographic asset into a usable form of savings.
Coldcard maker Coinkite's advisory says seeds generated on Mk2 and Mk3 firmware versions 4.0.1 through 4.1.9 are at risk when users did not add at least 50 fair, independent and private dice rolls and did not use a strong, unique BIP-39 passphrase. Separately, Coinkite says seeds created on Mk4, Mk5 and Q devices before their fixed releases were also affected, with about 72 bits of entropy rather than the expected 128 bits. The company lists fixed releases for the affected product tracks, but stresses that installing them does not alter a seed that already exists.
The operational instruction is therefore more demanding than an ordinary software update. Users must install the corrected firmware, create a new seed, verify its backup and receive address, send a small test transaction, and then move the remaining balance. Restoring the old seed into a new device does not solve the problem because the weakness belongs to the seed, not the casing that generated it. The same distinction explains why a careful hardware-wallet owner can still face a loss: physical isolation protects the signing process, but it cannot restore entropy that was absent at creation.
The Loss Estimate Is Growing, but the Categories Matter
The confirmed 1,596 BTC figure is the hard center of the story. Galaxy's latest accounting combines three major sweeps with 14 smaller incidents and maps them to roughly 7,300 source addresses. It excludes a suspected fourth wave because researchers had not received confirmation from the victims associated with those transactions. Galaxy nevertheless assigned that possible wave medium-high confidence and said including it would bring the estimate to about 2,055 BTC, worth roughly $130 million at the prices used in the estimate.
That distinction is not a technical footnote. It separates observed loss from attribution. Bitcoin's ledger can show coins leaving addresses that fit the attack pattern, but an address sweep can resemble an owner-initiated transfer. Victim confirmation supplies the missing link between a transaction pattern and a theft. Treating the $130 million case as confirmed would overstate the evidence; ignoring it would understate the live exposure. The responsible range is therefore more than $100 million confirmed, with a possible upper case near $130 million.
The progression of the estimate shows why the warning remains active. Earlier Galaxy updates had traced 1,367 BTC across 4,585 addresses. The latest total added hundreds of bitcoin and thousands of addresses as more victims came forward and investigators separated major waves from opportunistic activity. This is not a single breach that ended when a patch shipped. It is a discovery process running against a weakness that could have affected seeds generated years earlier.
Time also works differently for the attacker and the victim. The attacker can search a reduced key space offline and wait for funds to appear in a monitored address. The owner has to identify an uncertain historical event, install the right firmware track, create and verify a replacement, and move funds without making a second operational mistake. Coldcard's warning to proceed with care reflects that asymmetry: urgency reduces exposure, but rushed migration can create a new loss through a bad backup, a misread address or a compromised computer.
Coinkite says its fixed firmware prevents the issue from affecting new seeds, but does not repair old ones. Its advisory also says that at least 50 private, independent dice rolls provide at least 128 bits of entropy when added correctly. A strong and unique passphrase adds another barrier, although Coinkite still recommends migration because a passphrase can be weak, reused or forgotten. The affected codebase is not the Bitcoin network, and Coinkite says TAPSIGNER, OPENDIME and SATSCARD use different codebases and are not affected by this bug.
The Transmission Mechanism Runs Through Entropy, Not Bitcoin
The most important analytical point is that the incident is a key-generation failure, not a failure of Bitcoin's monetary or settlement system. A hardware wallet's promise rests on a chain: a random seed creates a private key, the private key controls addresses, and the device signs transactions without exposing it. Break the first link and the later air gap cannot restore security. The device can remain offline and the signature can remain valid while an attacker independently reconstructs the same key.
Coinkite's numbers show the mechanism. A standard 12-word seed is expected to have 128 bits of entropy. The company estimates that affected Mk4, Mk5 and Q seeds generated before the fixed releases had about 72 bits, while its warning identifies a more severe conditional risk for Mk2 and Mk3 users who did not supply sufficient dice input. The gap is not a small reduction in quality. Each missing bit halves the search space; losing 56 bits reduces the theoretical space by a factor of 2 to the power of 56. The practical risk depends on implementation and resources, but the direction is unambiguous: a supposedly unguessable secret becomes a target that can be ranked, searched and checked against funded addresses.
Why did the weakness survive? The answer is not simply that a line of code was wrong. The durable failure was a verification gap between an abstract security assumption and the wallet's production behavior. Users, reviewers and downstream security practices treated the hardware random-number source as part of the trust boundary. Once the firmware's fallback path produced weaker seeds, a device that still looked air-gapped and physically secure could produce compromised credentials. The visual and procedural cues remained intact while the underlying probability distribution changed.
That is why the event has structural implications for self-custody. The immediate attack is episodic: a set of vulnerable seeds can be swept, then the accessible population shrinks as users migrate. The security lesson is not cyclical, however. It changes the standard of due diligence from “Is the device offline?” to “How was this seed generated, on which firmware, with what independent entropy, and is the signing setup diversified?” Those questions do not disappear when this wave ends.
“Updating the firmware does not change or repair an existing seed.” — Coinkite, Coldcard Security Advisory, updated Aug. 1, 2026.
The second-order transmission runs into wallet architecture. A user who migrates one single-signature wallet to another device may solve the seed problem, but a multisignature arrangement built entirely from affected devices can preserve correlated risk. The hardware-wallet label is not a risk category by itself; the relevant category is whether independent signing keys were generated through independent, verifiable processes. That distinction favors custody designs that separate devices, vendors or entropy sources, while exposing setups that concentrated every quorum member on one affected code path.
It also creates a liquidity effect inside the crypto ecosystem. The stolen coins are not necessarily market-sell pressure: roughly 90% had not moved in Galaxy's latest update. But threatened users may move legitimate funds at the same time, increasing transaction demand, exchange deposits and address churn. A visible attacker balance can remain dormant while a larger group of owners changes behavior. The first-order effect is theft; the second-order effect is a temporary reallocation of liquidity and trust between self-custody, collaborative custody and custodial venues.
Bitcoin's price near $63,700 on Aug. 4, compared with the more than $100 million confirmed loss, illustrates the expectation gap. The stolen value is economically material to the victims but small relative to bitcoin's global market capitalization and daily turnover. The market therefore has little reason to price the event as a protocol shock. The assets most directly exposed are wallet makers, security vendors and custody providers, not every bitcoin holder equally.
Why the Patch Does Not Close the Incident
The patch closes a forward-looking software path; it does not close a historical exposure. That difference is the operational heart of the incident. A firmware update protects a seed generated after installation, but it cannot add randomness to words already written on paper. The old seed remains a liability until the balance is moved to a new seed whose origin and backup have been verified.
Coldcard's migration sequence is designed around failure containment. The user updates the device, generates a new seed while the device is empty, records the backup and fingerprint, verifies a receive address on the device screen, and sends a small test transaction before transferring the rest. The old backup should be retained until the full balance arrives and is confirmed. Each step addresses a different failure mode: an incorrect transcription, a wrong address, a malfunctioning replacement wallet or a user who destroys the only recovery path too early.
The need for a test transaction also exposes a broader cost of self-custody. Moving assets is not frictionless because there is no central administrator who can reverse an error. A user may understand the cryptography and still mishandle the migration. In a bank account, a compromised credential can often be replaced while the account relationship remains. In self-custody, the credential is the account relationship. Replacing it is a controlled transfer of property, and every control must be executed by the owner.
The counter-thesis is that this is a contained product incident with little relevance beyond Coldcard. Bitcoin held on exchanges, in custodial funds or in wallets built from unaffected codebases is not implicated by the specific flaw. Coinkite says several of its other products use different codebases, and the market's limited reaction supports the view that investors distinguish wallet implementation risk from protocol risk. If users can migrate successfully and no new attack waves appear, the incident could remain a large but finite product and reputation event.
That counter-thesis is credible, but it underestimates the correlation problem. Self-custody users often select devices precisely because they trust a security story, not because they independently audit entropy generation. An incident that reveals a years-old weak-randomness path can force a retrospective review of dormant balances, backups, firmware versions and multisignature quorums. The damage therefore compounds through uncertainty. The attack need not reach every device to impose costs on every serious user who must determine whether the device was ever used to generate a funded seed.
The signal that would falsify the structural-risk judgment is specific: if Coinkite and independent investigators verify that all confirmed thefts came from one narrow firmware-model cohort, no additional affected-model losses appear after affected users migrate, and the suspected fourth wave is disproved, the broader architecture thesis would weaken. Conversely, a confirmed new wave from a different affected model after users followed the published update-and-migrate procedure would show that the problem is broader than currently documented.
Coinkite's own language is unusually direct because the patch alone could create false reassurance.
“A new seed must be created, and funds moved to it to be secure.” — Coinkite, update published after the Coldcard vulnerability was confirmed.
The message turns software maintenance into asset migration. That is the correct framing for a self-custody incident: the device is not the asset, and updating the device is not the same as replacing the secret that controls the asset.
Three Horizons for Crypto Custody Risk
In the short term, sentiment and liquidity are the main variables. The confirmed tally can keep rising as victims identify sweeps, while the suspected fourth wave remains either promoted into the official count or removed. The key observable is not just the dollar estimate but the number of new victim addresses and the movement of the 90% of stolen bitcoin that remained dormant. A sudden transfer of those coins could raise exchange-monitoring and selling concerns, although the transaction alone would not prove liquidation.
In the medium term, the market will test whether migration is feasible at scale. The relevant data points are the number of additional confirmed addresses, the share of affected users who move funds to newly generated seeds, and whether new thefts stop after the fixed firmware releases. Custody providers and wallet developers may respond with clearer entropy attestations, independent audits and device-diversity guidance. Those changes could increase the cost of self-custody while also making its security claims more measurable.
In the long term, the event strengthens the case for layered custody rather than a binary choice between “your keys” and an exchange. The beneficiaries are firms that can provide verifiable key generation, recovery controls, independent signing paths and incident support. The exposed group is not simply Coldcard's installed base; it includes any wallet architecture that treats a single hardware vendor or firmware lineage as an adequate substitute for independent key security. That is a structural repricing of operational diligence, even if the immediate price impact on BTC is temporary.
The base case is a slowing but not immediately completed incident: confirmed losses rise modestly as more users report, the suspected fourth wave remains uncertain, and bitcoin trades primarily on macro and crypto-market drivers rather than the wallet event. The upside case for ecosystem confidence is that migration extinguishes the attack quickly, the fourth wave is rejected, and dormant stolen funds remain immobilized. The downside case is that investigators confirm the upper-case estimate near 2,055 BTC, identify additional model cohorts or observe movement from the stolen balance, forcing a wider reassessment of hardware-wallet assurances.
The falsifying signal remains the same. If no new affected-model thefts are confirmed after a documented migration period and the attack count stops expanding, the structural claim will have been too broad. If another wave appears despite fixed firmware and careful migration, the current loss estimates will be the least important part of the story.
Coldcard's final warning captures the timing problem: “The threat remains real and ongoing.” The event is cyclical in its attack bursts, but structural in what it teaches about self-custody. The patch ends the vulnerable generation path; only a new, verified seed ends the old one.
Explore more exclusive insights at nextfin.ai.
