Coldcard Users Urged to Migrate Seeds After $88.6M BTC Breach Traced

The Vulnerability and Fund Movement

Galaxy identified and traced 1,367.05 BTC—valued at $88.6 million—distributed across 4,585 addresses generated by Coldcard hardware wallets. The funds were linked to a vulnerability in how Coldcard produced seed phrases, the cryptographic foundation used to derive private keys and control cryptocurrency holdings.

Immediate Migration Guidance

Coldcard users holding funds in potentially affected wallets have been urged to migrate their seeds to a new secure wallet without delay. The migration involves generating a new seed phrase on a different device or updated Coldcard firmware and transferring all cryptocurrency from the vulnerable addresses to wallets derived from the new seed. Users should verify any firmware or software updates recommended by Coldcard before proceeding.

Context on Seed Generation Risk

Seed phrases are the master key to a hardware wallet; if the process generating them is flawed, all downstream private keys become predictable or derivable by an attacker. Galaxy's identification of funds across thousands of addresses suggests the vulnerability could affect a material portion of Coldcard's user base, though the exact number of exposed wallets remains unclear. Coldcard has not yet issued a public statement quantifying the scope or providing step-by-step recovery instructions as of this report.

Why It Matters

For Traders

If funds migrate from affected Coldcard addresses to exchanges over the next 24-48 hours, sell pressure could spike; monitor exchange inflows for unusual volume from these addresses.

For Investors

A material hardware wallet vulnerability erodes user confidence in non-custodial storage and may accelerate adoption of alternative custody solutions or staking services.

For Builders

Wallet and DeFi protocols should review their seed import and key derivation logic to ensure they do not re-use compromised keys; consider alerting users with Coldcard-derived addresses.