Coldcard Wallet Exploit Drains $38 Million in Bitcoin, Rocking Self-Custody Confidence Amid Broader Market Pressure
Key Takeaways
- •A flaw in Coldcard's random seed generation allowed attackers to mathematically reconstruct users' private keys without physical device access, draining roughly 600 BTC valued at approximately $38 million.
- •Coinkite shipped a hotfix protecting new seeds going forward, but previously generated seeds on vulnerable firmware remain at risk, prompting the CEO to urge immediate fund transfers.
- •President Trump's sharpened stance on Iran at a Camp David cabinet meeting reversed his earlier conciliatory tone and contributed to a 1.4% rise in WTI crude oil to $84.77 per barrel.
- •Core PCE, the Federal Reserve's preferred inflation measure, rose 3.3% year-on-year in June, remaining above the 2% target for the 64th straight month and sustaining upward pressure on Treasury yields.
- •The Bank of Japan maintained its benchmark rate at 1%, with Governor Ueda pointing to AI demand and the weak yen as factors expected to lift inflation above 2% later this fiscal year.

President Trump Takes Hard Line on Iran at Cabinet Meeting
"We will be hitting them very hard," President Trump stated at a cabinet meeting held at Camp David. "And you know at some point, they're going to say, 'We just can't take it anymore.'"
The remarks contrast sharply with Trump's comments earlier in the week, when he referenced "very friendly negotiations." WTI crude oil rose 1.4% on the day to $84.77, rebounding from a mid-week dip to $76 and now sitting roughly flat compared to its level the previous Friday. Bond yields continued climbing, with the 10-year Treasury yield rising another seven basis points to 4.73%, its highest level since late 2024. The escalating rhetoric compounds a broader risk-off backdrop — sticky inflation, surging government bond yields, and renewed Middle East uncertainty — that has weighed on bitcoin and other risk assets throughout the week.
'Move Your Funds Now': Coldcard CEO Responds to Wallet Exploit
Hardware wallets like the Coldcard are built specifically to keep private keys offline and beyond the reach of remote attackers — the foundation of their reputation as the most secure way to self-custody cryptocurrency. The exploit shattered that assumption: a vulnerability in how the device generated its random seed allowed attackers to mathematically reconstruct users' private keys without ever physically accessing the device. The flaw resides in the wallet's implementation, not in Bitcoin's underlying cryptography, but that distinction offers little comfort to those whose funds were swept in minutes.
"I'm sorry and I'm devastated," wrote Rodolfo Novak (@nvk), co-founder and CEO of Coinkite, which manufactures the Coldcard wallet. "Our team is heartbroken about yesterday's news."
"If you generated a seed using a Coldcard wallet, move your funds now, using our updated best practices, before reading further," he continued.
Coinkite has shipped a hotfix that will protect new seeds going forward, NVK said, but this does not remediate seeds already generated on vulnerable firmware.
"We believe this is a sober reality of the new AI paradigm," NVK wrote. "AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry's most seasoned experts. If your firmware is open-source or has ever been public, assume it's already being read by attackers and defenders alike."
Mt. Gox Comparisons Emerge After Coldcard Exploit
The amount of bitcoin (BTC) lost so far is relatively small — approximately 600 coins worth roughly $38 million — but the psychological blow to the Bitcoin industry has drawn far larger comparisons.
Mt. Gox, in which 850,000 bitcoin were lost in 2014, was an exchange exploit that for years served as Exhibit 1 for bitcoin maximalists arguing that everyone should move their coins off exchanges and into cold storage self-custody. With a vulnerability now found and exploited in Coldcard — one of the more respected cold storage solutions on the market — some observers believe the industry faces another Mt. Gox moment.
"Not hyperbolic, but this event is worse than Mt. Gox, affecting the most responsible and aware plebs among us," wrote Jessy Gilger.
"What FTX and Mt Gox did to promote self custody was just unwound by Coinkite and Coldcard," wrote Taylor Distler. "I'm afraid this Coldcard vulnerability is going to do more damage to self custody than anything else we've experienced … The ETFs and insured custody solutions will see major growth and to the non-technical, this hurts Bitcoin's reputation."
The Mt. Gox event catalyzed an approximately 80% plunge in the price of bitcoin in the ensuing weeks. Bitcoin has turned 3% lower as the ramifications of the Coldcard exploit became clear over the past 12 hours, though whether the decline is directly attributable to this event remains uncertain.
AI Accelerating Wallet Vulnerabilities, Says Trezor CTO
"Randomness is the foundation everything else in a hardware wallet stands on," wrote Trezor CTO Tomas Susanka. "Get it wrong and nothing else matters. Not the secure element, not the air-gap, not the metal backup."
"Weak entropy during initialization = funds drained 'remotely,'" he continued. "No device access needed, attacker just recomputes your keys."
"People think their wallet generated something truly random but it didn't," Susanka added. "Anyone who knows the pattern can work backward and recreate their private keys and AI is definitely speeding this up. We run dedicated safeguards to make sure that can never happen in our builds."
'Worst Hit in Bitcoin History': Industry Reactions to Coldcard Flaw
"This is the worst hit in Bitcoin history to the most knowledgeable and 'properly secured' Bitcoiners," said Guy Swann. "This isn't an exchange getting hack[ed] because of hit keys. This is thousands of individuals having their personal private keys recreated out from underneath them. This one hurts different."
Major bitcoin wallet flaw drains $38 million worth of BTC in 25-minute sweep
"The people affected by this have done everything right — studied Bitcoin, took the right precautions, separated their money from the state, invested in a hardware wallet and now wake up to the reality that their life savings have gone," wrote David Lawrence. "This is hugely damaging to the people who believe that 8 billion people will hold their bitcoin in cold storage in the future. That dream is over. Done."
"No amount of entropy or mathematical randomness can encrypt the future," said Charlie Shrem.
"An unfortunate aspect of being in the security business is that your 'paranoid' warnings tend to fall on deaf ears until catastrophe strikes," said Jameson Lopp. "Over a long enough time frame, bad things tend to happen. If your life savings are on the line, it's best to mitigate every edge case."
"The attacker appears to be a novice," wrote Block's Miles Suter. "Surprised that more sophisticated attacks haven't ramped up yet now that the scope of vulnerabilities is public. Urgency and extreme caution remain warranted in my opinion."
Bitcoin Slips Below $63,000 as U.S. Stocks Reverse Early Gains
After trading solidly higher in pre-market, U.S. stocks reversed course in early Friday morning trading, with the Nasdaq moving from approximately a 1% gain to a 0.4% decline. Already under pressure, bitcoin (BTC) pulled back to its weakest level of the week, down 3.2% over the past 24 hours to $62,600.
After a brief respite on Thursday, interest rates resumed their climb, with the 30-year Treasury bond rising five basis points to nearly a two-decade high of 5.26%. The 2-year yield rose six basis points to 4.29%.
Despite an 8% post-earnings decline for Apple, the Nasdaq appeared set to build on its near-3% surge from Thursday. Offsetting Apple's drop, Amazon gained 11.6% after topping earnings estimates and offering better-than-forecast guidance. Nasdaq 100 futures were higher by 1.2% roughly two hours before U.S. markets opened. Crypto markets, however, were broadly lower, with bitcoin down 1% over the past 24 hours to $63,900 and ether (ETH) off 1.7% to $1,884. WTI crude oil returned near the week's high, just shy of $85 per barrel, as traders positioned ahead of the weekend and potential Middle East escalations. Bond yields also resumed their ascent, with the 30-year U.S. Treasury back near a 19-year high at 5.22%.
'Bear Market Apathy': Bitcoin Volatility Nears Record Lows
"Implied volatility for bitcoin nearing its lowest levels on record," wrote Will Clemente on Friday morning. Weekly volatility, he said, is approaching 30%, or about one-third of the level seen in "hot" assets such as South Korea's Kospi, which soared 18% overnight but remains lower on the week. At the same time, Clemente noted, trading volume is at multi-year lows. "Bear market apathy things."
Fed's Preferred Inflation Gauge Stays Above 2% Target for 64th Consecutive Month
The Federal Reserve continues to reiterate its commitment to bringing inflation down to its 2% goal at every meeting, but progress remains elusive. Data released Thursday showed the Fed's preferred inflation metric, core PCE, rose 3.3% year-on-year in June. While that marks a slight decline from May's 3.4%, it remains well above the 2% target. This prolonged stretch of above-target inflation explains why bond yields remain elevated, weakening the bullish case for risk assets, including cryptocurrencies.
Bitcoin Steadies Near $64,000 as Bank of Japan Holds Rates at 1%
Bitcoin traded near $63,900 on Friday, roughly flat, as the Bank of Japan left its benchmark rate at 1% and Governor Kazuo Ueda's attempt to sound hawkish landed softly with markets. The yen gave back its move during his press conference, and the dollar-yen pair returned to where it started, as traders had already priced in a high probability of an October hike.
Ueda said inflation should rise above 2% later this fiscal year and pointed to AI demand and the weak yen as forces pushing prices higher — the same two threads that have shaped crypto's macro backdrop all month. A soft yen has fed the carry trade that channels money into risk assets, and the AI capital cycle is the trade bitcoin has tracked closely.
The broader market was quiet. Ether held near $1,885, while BNB extended its run as the standout large token, up 3.5% on the day and 4.4% on the week to approximately $591, according to CoinDesk data.