Hackers have stolen 594 Bitcoin, worth about $38 million, from roughly 500 COLDCARD hardware wallets after exploiting a security flaw tied to an older version of the device’s firmware.
According to security researchers, the attackers drained the funds in just 25 minutes, making it one of the most significant hardware wallet-related thefts in recent years.
The vulnerability has been traced back to firmware version 4.0.0, which was released in March 2021. Researchers say the flaw affected the way the wallet generated users’ private keys, the cryptographic codes that give owners complete control over their cryptocurrency.
How did the hack take place?
Private keys are essentially the passwords to a crypto wallet. If someone obtains or recreates them, they can access and transfer the funds without needing any additional authentication.
Hardware wallets like COLDCARD are designed to keep those keys offline, making them far more secure than online wallets or cryptocurrency exchanges. But like any electronic device, their security also depends on the software running on them.
In this case, researchers believe the weakness allowed attackers to compromise wallets that were still using the vulnerable firmware.
The incident is a reminder that hardware wallets, while considered one of the safest ways to store digital assets, are not completely immune to software bugs or security flaws.
Unlike smartphones or computers, hardware wallets typically don’t update themselves automatically. Users must manually install firmware updates, and many choose not to do so if their devices are working normally or are being used for long-term storage.
That can leave older devices running outdated software for years, potentially exposing them to vulnerabilities that have already been fixed in newer releases.
Researchers believe the attackers specifically targeted wallets running the affected firmware rather than launching a broad attack against every COLDCARD device.
The speed of the theft has also raised concerns.
Stealing nearly 600 Bitcoin from around 500 wallets in less than half an hour suggests the attackers had already identified vulnerable wallets and prepared the operation well in advance. Rather than acting randomly, the attack appears to have been carefully coordinated.
Scope of attack and fund recovery still unclear
It remains unclear exactly how many users were affected or whether any of the stolen funds can be recovered.
The incident is likely to reignite discussions around hardware wallet security, particularly the importance of keeping firmware updated even when devices are stored offline.
For crypto investors, the attack serves as another reminder that self-custody comes with ongoing security responsibilities. While hardware wallets remain one of the safest options for protecting digital assets, users still need to install security updates, follow manufacturer guidance and regularly review whether their devices are running the latest software.
As investigators continue to examine the breach, the incident highlights a broader lesson for the crypto industry: strong hardware alone is not enough. Long-term security also depends on maintaining secure software and ensuring critical vulnerabilities are patched before attackers can exploit them.
