Coldcard Firmware Flaw Drains Over $70M in Bitcoin as Liquidations Spike

Crypto market volatility peaked with over $101 million in liquidations within an hour. Notably, several users reported losing their stored Bitcoin due to a Coldcard vulnerability, despite taking the 'responsible' approach to securing their assets.

A five-year-old firmware defect in Coldcard hardware wallets was exploited over the final days of July, with attackers draining 1,082.65 BTC, worth roughly $70.2 million at the time, from 1,196 addresses in a 41-minute sweep . An earlier 25-minute sweep took about 594 BTC, or $38.3 million, from around 500 wallets . Separately, crypto futures liquidations across major exchanges topped $101 million in a single hour as prices fell, with forced liquidations reaching $359 million over 24 hours.

The root cause is unusually clean for a crypto loss event. A March 2021 firmware integration error, shipped in Coldcard 4.0.0, routed seed generation to a deterministic software pseudorandom number generator instead of the STM32 hardware random number generator . Keys created on affected firmware were therefore predictable. Every drained wallet was single-signature and held more than 0.15 BTC, and the affected coins span 2021 to 2026, matching the age of the flaw almost exactly . Manufacturer Coinkite shipped emergency firmware on July 31 (4.2.0 for Mk3, 5.6.0 for Mk4 and Mk5, 1.5.0Q for Q); affected holders must generate a fresh seed on patched firmware and move funds .

This is not the usual exchange-failure story, and that is what makes it market-relevant. The victims did the thing self-custody advocates recommend: they moved coins off exchanges onto dedicated hardware [doc3, doc6]. A silent entropy failure defeats that entire discipline, because nothing observable distinguishes a good seed from a bad one until the coins are gone. Coverage has already framed the episode as a possible push toward custodial and ETF exposure for holders who conclude they cannot audit their own key generation .

For listed proxies, the channel to watch is allocation preference rather than any direct financial exposure: spot bitcoin ETFs and custodial venues including COIN could see relative inflow if self-custody confidence erodes, while the liquidation cascade is a separate, leverage-driven move that says more about positioning than about the exploit. Neither effect is confirmed in flow data yet, and the immediate signal to track is whether ETF net creations diverge from spot price action over the next several sessions.