Bitcoin’s hardware wallet ecosystem is facing a rare and dangerous moment. The maker of Coldcard has confirmed that an exploit still actively draining funds from specific devices has already led to roughly $114 million in losses, and the flaw remains unpatched as of Tuesday. The company is telling users to move their bitcoin off vulnerable hardware immediately, according to the original report.
The warning lands after weeks of escalating concern among Coldcard owners. The exploit appears to target certain firmware versions and hardware configurations, bypassing the normal security checks that make hardware wallets a cornerstone of self-custody. Unlike phishing attacks or seed phrase leaks, this is a direct compromise of the device layer, making the default advice—keep your private keys offline—less reliable. The vulnerability may be firmware-specific, which would explain why some devices remain unaffected while others are being drained.
The Scale and Silence
The Bitcoin security community, often vocal on forums and social media, has responded with a mixture of alarm and pragmatism. Longtime Coldcard users are sharing experiences of drained balances, while others debate whether the device’s open-source firmware could have caught the flaw earlier. Coldcard has not publicly detailed which models are vulnerable, how the exploit works, or whether a fix is on the immediate horizon. That secrecy likely serves an operational purpose: broadcasting technical specifics could hand attackers a template. Yet it also leaves users in a state of anxious uncertainty.
For years, Coldcard has been a favorite among Bitcoin maximalists who prize its air-gapped design and Bitcoin-only firmware. The device was marketed as a fortress for the most paranoid holders. Now that fortress has a crack, and the silence from the manufacturer about the timeline for a patch has fueled speculation that the root cause may be deep-seated, perhaps tied to a supply chain vulnerability or a flaw introduced during a firmware update months ago.
A Broader Self-Custody Dilemma
Hardware wallet exploits are not new—previous incidents have hit devices from Ledger and Trezor—but the scale here is notable. The Coldcard situation underscores a persistent tension: self-custody is widely promoted as the antidote to exchange risk, yet it concentrates technical responsibility onto a single user who may not have the expertise to evaluate the integrity of their device. The industry has long assumed that a properly manufactured and up-to-date hardware wallet is impervious to remote attacks. That assumption is now under serious strain.
The immediate guidance to move funds to another wallet, often a hot wallet on a smartphone, introduces a different set of risks. Users fleeing a compromised hardware device may expose their private keys to a less secure environment. It’s a trade-off between a confirmed threat and an uncertain one, and security practitioners will weigh the decision on factors the average holder cannot easily judge.
What Remains Uncertain
It is not yet known whether the exploit can be triggered remotely, requires physical access, or exploits a vulnerability in companion software used during transaction signing. The lack of clarity complicates the defensive steps users can take. Short of migrating funds entirely, even a firmware update might not be sufficient if the hardware itself is compromised at the bootloader level. Coldcard will need to release a comprehensive technical post-mortem once the threat is contained—something that, for now, seems days or weeks away.
Whether affected users can recover any portion of the stolen funds through on-chain tracing or legal intervention is an open question. Bitcoin’s transparent ledger can help follow the money, but pseudonymity makes enforcement difficult. Historically, individual victims of hardware wallet exploits rarely see restitution. The broader impact on hardware wallet sales, particularly among the Bitcoin-native crowd, may depend entirely on how quickly Coldcard responds.
The message from the manufacturer is straightforward, even if the silence on details is not: if you own one of the vulnerable devices, assume it is compromised and move your bitcoin before you become the next case in this growing tally of losses.
