*Coldcard Flaw Drains 594 BTC: What Happened And How To Stay Safe*
A critical vulnerability linked to Coldcard hardware wallets has reportedly led to the loss of *594 BTC*, sending shockwaves through the Bitcoin self-custody community.
*What We Know So Far*
Details are still emerging, but the reported flaw appears to involve how transaction signing and firmware verification were handled on affected Coldcard devices. Attackers allegedly exploited the vulnerability to bypass standard security checks and drain funds from wallets totaling *594 BTC* — roughly $24M+ at current prices.
Coldcard, made by Coinkite, is one of the most popular air-gapped Bitcoin hardware wallets. It’s known for its offline signing and PSBT workflow. Because of that, the news has triggered major concern about supply chain attacks, compromised firmware, and social engineering.
How The Alleged Drain Worked*
While Coinkite has not confirmed all details yet, security researchers point to 3 possible vectors:
1. *Compromised Firmware*: Malicious firmware flashed via fake update files
2. *Supply Chain Tampering*: Devices intercepted and pre-loaded with backdoored software
3. *User Error + Phishing*: Fake Coldcard sites tricking users into entering seed phrases
The 594 BTC figure suggests this wasn’t a single user. It points to multiple victims or a coordinated exploit.
1. *Verify Firmware*: Only update via Coldcard’s official site. Check PGP signatures
2. *Check Device Authenticity*: Use the "bag number" and tamper-evident seals Coinkite provides
3. *Never Enter Seed Online*: Coldcard is air-gapped for a reason. If a site asks for your 12/24 words, it’s a scam
4. *Move Funds If Unsure*: If you bought from a 3rd party seller, consider sweeping funds to a new wallet
The Bigger Picture*
This is a reminder: *"Not your keys, not your coins"* only works if your keys are actually secure. Hardware wallets are safer than exchanges, but they’re not unhackable. Supply chain and human error are still the #1 risks
Coinkite is expected to release an official statement and patch soon. The Bitcoin community is also calling for better reproducible builds and multisig by default.
#ColdcardFlawDrains594BTC #XRPLedgerProposesLettingBanksCoverUserFees #AmazonRaises2026CapexTo$220B
