Coldcard, by Coinkite, was a gold standard for offline Bitcoin storage — until a March 2021 firmware bug left private keys mathematically guessable.
Galaxy Research now tracks $88.6 million gone across 4,585 addresses. Researcher Alex Thorn says the sweeps are automated, likely LLM-driven, and every vulnerable address *will* be drained — stolen coins had averaged 3.18 years of dormancy before vanishing.
Canadian coach Jonathan Goodman lost 18.25
BTC in seven minutes, keys stored in a safety deposit box, never online. "I did everything right," he wrote.Affected users are fleeing back to exchanges. The industry that spent a decade chanting "not your keys, not your coins" is quietly learning that Coinbase is sometimes the safer bet.
Decrypt has the full breakdown.