Coinkite, the maker of the Coldcard Bitcoin hardware wallet, told Bloomberg it is focused on assisting affected customers and will publish a post-mortem of the days-long security incident that has drained bitcoin from thousands of addresses. The company declined to estimate the scale of customer losses, even as outside trackers have pegged the damage between $100 million and $130 million.
The vulnerability traces back to firmware version 4.0.0, live since March 2021, which caused affected Coldcard devices to bypass their dedicated hardware randomness chip during key generation and rely on a predictable software substitute instead. That flaw let an attacker guess bitcoin seed phrases and, according to reporting on the exploit, drain roughly 1,816 BTC from about 5,200 addresses. The bug affects certain Mk3 devices running firmware 4.0.1 or later, along with Mk4, Mk5, and Q devices on older firmware versions.
No compensation offered yet
Coinkite has not offered compensation to affected users as of its statement to Bloomberg, positioning its current role as assisting victims rather than covering losses. The company's decision to withhold a loss estimate until its post-mortem is complete leaves the final damage figure — and any question of remediation — unresolved for now, even as on-chain trackers continue to follow the attacker's movements.
The hacker hasn't stopped moving funds
The exploit has continued to generate on-chain activity well after the initial drain, with the hacker resuming movement of stolen bitcoin in the days since the attack was first detected. That ongoing activity has made the incident one of the more closely watched hardware-wallet security failures in recent memory, given Coldcard's reputation as a security-focused cold-storage device explicitly designed to keep private keys offline and away from this kind of remote compromise.
Related: Coldcard Exploit Hacker Resumes Moving Stolen Bitcoin
Coinkite has not given a timeline for when its post-mortem will be published.
