A 41-minute Bitcoin heist stole $70 million from 1,196 addresses. Galaxy Research traced it to a Coldcard firmware flaw from 2021 that broke randomness.
You'd think stealing $70 million in Bitcoin would require some kind of James Bond-level hacking operation. Lasers, mainframes, maybe a team of cyber ninjas in a dark room somewhere. But according to a new report from Galaxy Research, the whole thing came down to a tiny mistake in a hardware wallet's code that had been sitting there for years, waiting to be exploited.
On July 30, an attacker drained 1,196 Bitcoin addresses in just 41 minutes. That's a staggering 1,082.65 BTC, worth roughly $70.2 million at the time. The speed alone is terrifying. It wasn't a slow, careful extraction. It was a sweep, a digital vacuum cleaner that just went through and sucked everything up.
### The Coldcard Connection
Galaxy Research did the forensic work and tied this massive theft to a specific hardware wallet: the Coldcard, a Bitcoin-only device made by the Canadian company Coinkite. Coldcard has a reputation in the crypto community for being one of the most secure, paranoid, and privacy-focused wallets you can buy. It's the kind of device that people trust with their life savings.
So how did it fail? The culprit is a firmware integration error that dates all the way back to March 2021. During the development of a particular firmware update, the code that generates your wallet's seed phrase got routed to the wrong place. Instead of using the hardware's true random number generator, which pulls entropy from physical processes, it fell back to a deterministic software pseudorandom number generator (PRNG).
For the non-engineers out there, this is a huge deal. A PRNG is predictable. It's a formula. If you know the starting point, you can recreate every "random" number it produces. A hardware wallet is supposed to be the opposite of that. It's supposed to be a fortress of unpredictability.
### Why This Matters to You
Here's the thing that makes this so unsettling: the affected users didn't do anything wrong. They didn't click a phishing link. They didn't hand over their seed phrase to a scammer. They just used a trusted device, and their funds were gone in under an hour.
- The attack was executed with surgical precision, targeting only addresses generated by the flawed firmware.
- The entire sweep took less time than a typical commute to work.
- The vulnerability was dormant for over three years before being exploited.
It's a stark reminder that even the most secure hardware can have a hidden Achilles' heel. The physical security of the device doesn't matter if the code inside has a fatal flaw.
### The Takeaway for Crypto Users
If you're holding a Coldcard, the first step is to check your firmware version. If you updated your device between March 2021 and the date of the fix, you need to be concerned. The safest move is to migrate your funds to a completely new wallet with a freshly generated seed phrase from a verified, up-to-date device.
Don't just update the firmware and assume you're safe. The damage is already done if your seed was generated by that flawed PRNG. Your keys are compromised, and no update can fix that. You need a new identity, a new seed, a new wallet.
This whole incident is a brutal lesson in the importance of understanding the layers of security in crypto. We obsess over phishing attacks and exchange hacks, but sometimes the danger is baked into the hardware we trust the most. The next time you set up a wallet, take a moment to appreciate the complexity of what's happening behind the scenes. A single line of code, routed incorrectly, can cost you everything.
