Large-scale Coldcard compromise (1596 BTC stolen so far)

[Meuserna]

Usually those researchers would definitely do a nice work if they are just well compensated with their jobs or bugs found in their platform. But the inconsistencies of Coinkite and other bad response discourage their researchers.

While hackers always have motivation to study their platform and find flaws. This is the reason why the recent losses they get for this year is so devastating, because Coinkite made huge negligence.

If they just do the right thing and pays their obligations, then motivate them to do more better work. Maybe they won't experience or at least they can possibly minimize the damage.

Even if Coinkite was paying big bounties and encouraging people to hack their code, I don't think it would have prevented this... especially if the bounties come with nondisclosure agreements to prevent the white-hat hackers who find bugs from telling anyone what they found. Ledger's bounties come with NDAs, and some Ledger bugs have been shown to exist long after they were found because the person who found the bug was paid to keep it secret.

By making their code "Source Viewable" instead of open source, Coinkite blocked people from battle testing their code by putting it to work in their own projects.

For example, Trezor bugs get found and fixed because so many devs use Trezor's code in their own work.

I won't be surprised at all if we start seeing other brands that use closed source code getting exploited, leading to catastrophic losses.

Bitcoin is open source. I strongly believe hardware wallets need to be open source too. If the code isn't open source, criminals will be the only ones doing the work to find exploits. And they'll find 'em.

[Just Say]

However, i feel like the Coinkite reward system has not always been predictable, so it’s possible that they may have made some past confrontational responses to some researchers and critics at one point in time, which may have discouraged the security researchers from voluntarily spending their time to audit Coinkite’s code.
These large losses that they faced in 2026 is obvious proof of what serious vulnerabilities can cause the user’s bitcoin security when they go undetected.

Yes, the primary reason the Coldcard hardware wallet was hacked was a critical coding error in its 2021 firmware version 4.0.1 as a result hackers exploited that vulnerability to steal over 1,800 bitcoins worth approximately $116 million.and suffer massive losses in 2026, proving that undetected vulnerabilities pose a major risk to customers' bitcoin security. Even another thing to note is that Cold Card's official X account published a post with a phishing link and they have already deleted that post. At this stage, it can be said that this year will likely go down as one of the most dramatic years for hardware wallet security.

We are investigating how a post containing a phishing link was published from this account. It has since been deleted. Do not visit or interact with that link. COLDCARD’s only official website is coldcard.com.This account has used offline 2FA with tightly restricted access since 2017. We have contacted @X and are reviewing all account access. We will share further verified updates here.

[Pmalek]

We are investigating how a post containing a phishing link was published from this account. It has since been deleted. Do not visit or interact with that link. COLDCARD’s only official website is coldcard.com.This account has used offline 2FA with tightly restricted access since 2017. We have contacted @X and are reviewing all account access. We will share further verified updates here.

When you think it can't possible become any worse for Coldcard, this happens. They claim they have offline 2FA with strict restriction access. Perhaps there is one or multiple malicious individuals in the team that have the needed access rights. Could they have been hacked/phished? Another explanation is that it's a vulnerability in X that allows a third party to access and post from accounts, even those with 2FA protection.

[ObeyKnock]

When you think it can't possible become any worse for Coldcard, this happens. They claim they have offline 2FA with strict restriction access. Perhaps there is one or multiple malicious individuals in the team that have the needed access rights. Could they have been hacked/phished? Another explanation is that it's a vulnerability in X that allows a third party to access and post from accounts, even those with 2FA protection.

Never click “urgent security” or migration links through social media. Verify on their website (in Coldcard’s case, coldcard.com) or through other independent communication channels.

Coldcard issued a statement about what happened. Apparently they have had offline 2FA since 2017. They also dont see any indication of an active session or even a login in their records, which leaves open the possibility of an issue with X or some kind of platform level vulnerability. Either way it serves as a great reminder that even the most careful teams can fall victim to issues with third party services.

[ryzaadit]

Could they have been hacked/phished? Another explanation is that it's a vulnerability in X that allows a third party to access and post from accounts, even those with 2FA protection.

which leaves open the possibility of an issue with X or some kind of platform level vulnerability. Either way it serves as a great reminder that even the most careful teams can fall victim to issues with third party services.

Most likely, they fell victim to some third-party apps (clone) being linked to their account.


I have experience facing some hacked accounts on X, working on some projects. The hacker can still access the account, even though the team has already taken back the account with some (2FA/Change the password). Then, after several checks and investigations, the one who are handling the account fell for some clone apps called "Calendly," perhaps due to partnership offers and requests for meetings by sharing meeting times with those apps.

Usually in these schemes, the one who got access doesn't need (2FA/Password) they can bypass those with a cache stealer, or something like TokenID for Discord, and I believe in X is called (auth_token) to bypass everything.

[NotATether]

Most likely, they fell victim to some third-party apps (clone) being linked to their account.

It doesn't get any better for these clowns, does it?

Your hardware wallet gets hacked, from a bug which you neglected to audit (possibly introduced by you). Hundreds of your customers lose thousands, even millions of dollars. For some reason you destroy inventory but don't suspend sales or halt business.

Now you let your X account get phished and post a phishing link to your own followers.

Do they have any shame left at Coinkite? Just fold the product, it's over!

[Stalker22]

I am literally stunned at what I have just read.  After everything that has gone down with Coldcard - firmware screwups, the catastrophic failure of customer service, the incompetence here is frankly shocking.  You would think a business entrusted with custody of Bitcoin holdings worth hundreds of millions of dollars would be operating at the highest levels of accountability, and technical rigor.  Instead its just one blunder after another.

It is getting really hard to tell if Coinkite is a pure evil or just insanely incompetent.

[tvbcof]

I am literally stunned at what I have just read.  After everything that has gone down with Coldcard - firmware screwups, the catastrophic failure of customer service, the incompetence here is frankly shocking.  You would think a business entrusted with custody of Bitcoin holdings worth hundreds of millions of dollars would be operating at the highest levels of accountability, and technical rigor.  Instead its just one blunder after another.

It is getting really hard to tell if Coinkite is a pure evil or just insanely incompetent.

My bet is that they know exactly what they are doing.

Valuable insight might be had by noting who has quickly leapt to their defenses with tidy and innocent explanations, and with whom they have been especially chummy over the years.

[ryzaadit]

Do they have any shame left at Coinkite? Just fold the product, it's over!

Shame, no? But a mountain of leftover product- yes, they have many. They still can milk these to the last drop; I guess the last one will be selling his company to someone else or rebranding. Back again with a new shitty product with a different brand name.

I am literally stunned at what I have just read.

No need to be stunned by Coldcard. We know something like this can happen again with them, people who are still using their product, even for something else, deserve to be scammed again.

[ObeyKnock]

Usually in these schemes, the one who got access doesn't need (2FA/Password) they can bypass those with a cache stealer, or something like TokenID for Discord, and I believe in X is called (auth_token) to bypass everything.

Session token stealing is a known pattern, often using fake Calendly/Zoom invite apps. In those cases (posting with a stolen auth_token) there should still be some indication of the session in the logs, which Coldcard apparently did not find during their review:
Coldcard statement noted that no matching access, session or login could be found in their logs for unauthorized post, suggesting it could have been done through X platform level or admin level access, as reported in some media, other than by compromising or tricking team member into handing over a session token.

[tvbcof]

No need to be stunned by Coldcard. We know something like this can happen again with them, people who are still using their product, even for something else, deserve to be scammed again.

I still use the CCQ I have.  OK, sure, I deserve to be scammed.  Whatever.  I'll follow up on this thread if I do.  If I do not, what do you suppose that means?

I believe it highly possible that every key ever created by Coldcard no matter what firmware it was running (if the firmware came from Coinkite), and what dice/passphrase used, is insecure and I still use the device.  The real risk I see is that Coinkite and the guys who did the wallet I am using (also 'Canadian') have colluded to use the wallet to exfiltrate key material from the off-line device.  I see the risk as minor and actually not all that difficult to check (by evaluating the BBQR) but I have not gotten around to doing it.  If I lose my bet, I lose a certain fairly small percentage of my BTC and it's a risk I'm willing to take.  Shrug.

I think that there is a fair chance that a certain percentage of other hardware device providers are as corrupt+incompetent as Coinkike.  As much as I like the basic theory of operation of splugesigner or whatever the the name of the thing that the Meurmousa guy promotes, I'm more inclined to put my trust in a much simpler device.  That is, one which starts from nothing and builds up rather than carrying 30 years of time-sharing OS baggage and sophisticated hardware of the type which tends to get back-doored if it is allowed to be sold at all.  Beyond that, a scheme whereby multiple air-gapped unlock keys are required (while I agree with it heartily) requires a fair bit of planning and implementation.

While I go about the significant research and design of an enduring solution to the off-line signing problem, I'm happy enough to limp along with the Coinkike hardware I have rather than to get in a panic.  But that's just me.  As always, I recommend that most people do NOT do as I do.  But also, don't act like some sorts of lords of technological understanding and belittle others who are probably vastly more knowledgeable about a lot of this stuff than yourselves.  And if you must, be good enough to provide some detail as to why and what the fuck you are worried about.