Coldcard is among Bitcoin's most trusted hardware wallets. A March 2021 firmware build hid a quiet catastrophe: seeds were generated by a predictable software randomiser instead of the hardware chip, leaving a bounded key space anyone can reproduce offline.
Galaxy Research has now flagged a third sweep wave. Total across all three: 1,367 BTC (~$89M) from 4,585 addresses. Wave one averaged ~1 coin per victim; wave three is down to ~0.1
BTC. The fat wallets are running out.The pattern shifted too — no more shared collector addresses, each victim gets a unique destination. One operator adapting, or a second one mining the same flaw? The chain won't say.
"Cold" refers to the internet connection. Not the math.
CoinDesk