Attackers stole 594 Bitcoin from 500 hardware wallets in a single operation, according to blockchain analytics firm Atlas21.
The thieves swept 1,324 unspent transaction outputs, each transaction emptying exactly one victim address. As of the report, 562 Bitcoin sat at a new address and 32 at an intermediate address, with none yet moved to an exchange or crypto mixer.
Median losses per victim were 0.41 BTC, roughly $26,500. The largest single loss reached 29.9 BTC, close to $2 million. No victim lost less than 0.15 BTC, leading security specialists to suggest the attackers filtered wallets by minimum balance. Some 110 victims lost more than 1 Bitcoin.
The investigation began after a Reddit user reported the theft. The user said they had bought a Coldcard hardware wallet in 2021, generated a 24-word seed phrase directly on the device, left the funds untouched for years, then re-entered the old seed phrase on a second Coldcard device in January of last year to verify it.
Coinkite, the manufacturer, acknowledged a security issue affecting seed phrases generated on Coldcard Mk3 devices running firmware version 4.0.1, released in March 2021, or any later version. The Mk4, Q, and Mk5 models are unaffected, the company said. Coinkite recommended Mk3 owners add a unique BIP-39 passphrase and move funds to a new wallet, but said the root cause has not been identified. None of the affected wallets used multisignature security.
Atlas21 analysts suggested the problem lies in weak seed phrases rather than the hardware itself, with private keys potentially guessable due to insufficient randomness during seed phrase generation.
