Large-scale Coldcard compromise (1596 BTC stolen so far)

[Meuserna]

Usually those researchers would definitely do a nice work if they are just well compensated with their jobs or bugs found in their platform. But the inconsistencies of Coinkite and other bad response discourage their researchers.

While hackers always have motivation to study their platform and find flaws. This is the reason why the recent losses they get for this year is so devastating, because Coinkite made huge negligence.

If they just do the right thing and pays their obligations, then motivate them to do more better work. Maybe they won't experience or at least they can possibly minimize the damage.

Even if Coinkite was paying big bounties and encouraging people to hack their code, I don't think it would have prevented this... especially if the bounties come with nondisclosure agreements to prevent the white-hat hackers who find bugs from telling anyone what they found. Ledger's bounties come with NDAs, and some Ledger bugs have been shown to exist long after they were found because the person who found the bug was paid to keep it secret.

By making their code "Source Viewable" instead of open source, Coinkite blocked people from battle testing their code by putting it to work in their own projects.

For example, Trezor bugs get found and fixed because so many devs use Trezor's code in their own work.

I won't be surprised at all if we start seeing other brands that use closed source code getting exploited, leading to catastrophic losses.

Bitcoin is open source. I strongly believe hardware wallets need to be open source too. If the code isn't open source, criminals will be the only ones doing the work to find exploits. And they'll find 'em.

[Just Say]

However, i feel like the Coinkite reward system has not always been predictable, so it’s possible that they may have made some past confrontational responses to some researchers and critics at one point in time, which may have discouraged the security researchers from voluntarily spending their time to audit Coinkite’s code.
These large losses that they faced in 2026 is obvious proof of what serious vulnerabilities can cause the user’s bitcoin security when they go undetected.

Yes, the primary reason the Coldcard hardware wallet was hacked was a critical coding error in its 2021 firmware version 4.0.1 as a result hackers exploited that vulnerability to steal over 1,800 bitcoins worth approximately $116 million.and suffer massive losses in 2026, proving that undetected vulnerabilities pose a major risk to customers' bitcoin security. Even another thing to note is that Cold Card's official X account published a post with a phishing link and they have already deleted that post. At this stage, it can be said that this year will likely go down as one of the most dramatic years for hardware wallet security.

We are investigating how a post containing a phishing link was published from this account. It has since been deleted. Do not visit or interact with that link. COLDCARD’s only official website is coldcard.com.This account has used offline 2FA with tightly restricted access since 2017. We have contacted @X and are reviewing all account access. We will share further verified updates here.

[Pmalek]

We are investigating how a post containing a phishing link was published from this account. It has since been deleted. Do not visit or interact with that link. COLDCARD’s only official website is coldcard.com.This account has used offline 2FA with tightly restricted access since 2017. We have contacted @X and are reviewing all account access. We will share further verified updates here.

When you think it can't possible become any worse for Coldcard, this happens. They claim they have offline 2FA with strict restriction access. Perhaps there is one or multiple malicious individuals in the team that have the needed access rights. Could they have been hacked/phished? Another explanation is that it's a vulnerability in X that allows a third party to access and post from accounts, even those with 2FA protection.

[ObeyKnock]

When you think it can't possible become any worse for Coldcard, this happens. They claim they have offline 2FA with strict restriction access. Perhaps there is one or multiple malicious individuals in the team that have the needed access rights. Could they have been hacked/phished? Another explanation is that it's a vulnerability in X that allows a third party to access and post from accounts, even those with 2FA protection.

Never click “urgent security” or migration links through social media. Verify on their website (in Coldcard’s case, coldcard.com) or through other independent communication channels.

Coldcard issued a statement about what happened. Apparently they have had offline 2FA since 2017. They also dont see any indication of an active session or even a login in their records, which leaves open the possibility of an issue with X or some kind of platform level vulnerability. Either way it serves as a great reminder that even the most careful teams can fall victim to issues with third party services.

[ryzaadit]

Could they have been hacked/phished? Another explanation is that it's a vulnerability in X that allows a third party to access and post from accounts, even those with 2FA protection.

which leaves open the possibility of an issue with X or some kind of platform level vulnerability. Either way it serves as a great reminder that even the most careful teams can fall victim to issues with third party services.

Most likely, they fell victim to some third-party apps (clone) being linked to their account.


I have experience facing some hacked accounts on X, working on some projects. The hacker can still access the account, even though the team has already taken back the account with some (2FA/Change the password). Then, after several checks and investigations, the one who are handling the account fell for some clone apps called "Calendly," perhaps due to partnership offers and requests for meetings by sharing meeting times with those apps.

Usually in these schemes, the one who got access doesn't need (2FA/Password) they can bypass those with a cache stealer, or something like TokenID for Discord, and I believe in X is called (auth_token) to bypass everything.

[NotATether]

Most likely, they fell victim to some third-party apps (clone) being linked to their account.

It doesn't get any better for these clowns, does it?

Your hardware wallet gets hacked, from a bug which you neglected to audit (possibly introduced by you). Hundreds of your customers lose thousands, even millions of dollars. For some reason you destroy inventory but don't suspend sales or halt business.

Now you let your X account get phished and post a phishing link to your own followers.

Do they have any shame left at Coinkite? Just fold the product, it's over!

[Stalker22]

I am literally stunned at what I have just read.  After everything that has gone down with Coldcard - firmware screwups, the catastrophic failure of customer service, the incompetence here is frankly shocking.  You would think a business entrusted with custody of Bitcoin holdings worth hundreds of millions of dollars would be operating at the highest levels of accountability, and technical rigor.  Instead its just one blunder after another.

It is getting really hard to tell if Coinkite is a pure evil or just insanely incompetent.

[tvbcof]

I am literally stunned at what I have just read.  After everything that has gone down with Coldcard - firmware screwups, the catastrophic failure of customer service, the incompetence here is frankly shocking.  You would think a business entrusted with custody of Bitcoin holdings worth hundreds of millions of dollars would be operating at the highest levels of accountability, and technical rigor.  Instead its just one blunder after another.

It is getting really hard to tell if Coinkite is a pure evil or just insanely incompetent.

My bet is that they know exactly what they are doing.

Valuable insight might be had by noting who has quickly leapt to their defenses with tidy and innocent explanations, and with whom they have been especially chummy over the years.

[ryzaadit]

Do they have any shame left at Coinkite? Just fold the product, it's over!

Shame, no? But a mountain of leftover product- yes, they have many. They still can milk these to the last drop; I guess the last one will be selling his company to someone else or rebranding. Back again with a new shitty product with a different brand name.

I am literally stunned at what I have just read.

No need to be stunned by Coldcard. We know something like this can happen again with them, people who are still using their product, even for something else, deserve to be scammed again.

[ObeyKnock]

Usually in these schemes, the one who got access doesn't need (2FA/Password) they can bypass those with a cache stealer, or something like TokenID for Discord, and I believe in X is called (auth_token) to bypass everything.

Session token stealing is a known pattern, often using fake Calendly/Zoom invite apps. In those cases (posting with a stolen auth_token) there should still be some indication of the session in the logs, which Coldcard apparently did not find during their review:
Coldcard statement noted that no matching access, session or login could be found in their logs for unauthorized post, suggesting it could have been done through X platform level or admin level access, as reported in some media, other than by compromising or tricking team member into handing over a session token.

[tvbcof]

No need to be stunned by Coldcard. We know something like this can happen again with them, people who are still using their product, even for something else, deserve to be scammed again.

I still use the CCQ I have.  OK, sure, I deserve to be scammed.  Whatever.  I'll follow up on this thread if I do.  If I do not, what do you suppose that means?

I believe it highly possible that every key ever created by Coldcard no matter what firmware it was running (if the firmware came from Coinkite), and what dice/passphrase used, is insecure and I still use the device.  The real risk I see is that Coinkite and the guys who did the wallet I am using (also 'Canadian') have colluded to use the wallet to exfiltrate key material from the off-line device.  I see the risk as minor and actually not all that difficult to check (by evaluating the BBQR) but I have not gotten around to doing it.  If I lose my bet, I lose a certain fairly small percentage of my BTC and it's a risk I'm willing to take.  Shrug.

I think that there is a fair chance that a certain percentage of other hardware device providers are as corrupt+incompetent as Coinkike.  As much as I like the basic theory of operation of splugesigner or whatever the the name of the thing that the Meurmousa guy promotes, I'm more inclined to put my trust in a much simpler device.  That is, one which starts from nothing and builds up rather than carrying 30 years of time-sharing OS baggage and sophisticated hardware of the type which tends to get back-doored if it is allowed to be sold at all.  Beyond that, a scheme whereby multiple air-gapped unlock keys are required (while I agree with it heartily) requires a fair bit of planning and implementation.

While I go about the significant research and design of an enduring solution to the off-line signing problem, I'm happy enough to limp along with the Coinkike hardware I have rather than to get in a panic.  But that's just me.  As always, I recommend that most people do NOT do as I do.  But also, don't act like some sorts of lords of technological understanding and belittle others who are probably vastly more knowledgeable about a lot of this stuff than yourselves.  And if you must, be good enough to provide some detail as to why and what the fuck you are worried about.

[Pmalek]

I just saw this news today although it happened in September. A Bitlist search showed that it hasn't been mentioned yet.

A class action lawsuit has been filed against Coinkite in Ontario, Canada.
The link to it on the Ontario Courts Public Portal is this one: https://courts.ontario.ca/portal/court/68f021c4-6a44-4735-9a76-5360b2e8af13/case/69d7faae-6bfd-4056-95be-f2c5cf5e5fe3
You need a Canadian VPN to open it.

Here is an image of the filed case:


Source:
https://stacker.news/items/1600161

[SquirrelJulietGarden]

I just saw this news today although it happened in September. A Bitlist search showed that it hasn't been mentioned yet.

A class action lawsuit has been filed against Coinkite in Ontario, Canada.
The link to it on the Ontario Courts Public Portal is this one: https://courts.ontario.ca/portal/court/68f021c4-6a44-4735-9a76-5360b2e8af13/case/69d7faae-6bfd-4056-95be-f2c5cf5e5fe3
You need a Canadian VPN to open it.

The lawsuit is very well expected because such incident with massive and very severe losses for many people as customers of Coinkite can not be considered as nothing and Coinkite must be responsible for this incident as well as compensation for users.

We still don't know it is a pure incident from actual hackers or it's a security hole that was planned as a hardware wallet scam exit from Coinkite. Only time with further investigation can tell us what actually happened with Coldcard incident.

Hardware wallets don't have too big business revenue like centralized exchanges have but if they caused losses of users, they have responsibility and one of such is compensation for users.

[tvbcof]

...
A class action lawsuit has been filed against Coinkite in Ontario, Canada.
...

Kudos to the filer.  If this goes anywhere, it will be quite interesting to find out how well and how far back the defendants started building up their defenses.  That seems to me the real value.

It would be super-cool if any of those who suffered losses got some gain, but I don't hold out much hope...unless defendants are a part of a much larger operation and settle for the purposes of keeping certain things hidden.

In the event of another price leg-up, it could also be that victims get paid out in cash for the value at the time of the loss while the haul remains an endless source of 'retirement' for the perps.  This is actually a very common pattern outcome of a crime in Bitcoinland historically.

[Pmalek]

The lawsuit is very well expected because such incident with massive and very severe losses for many people as customers of Coinkite can not be considered as nothing and Coinkite must be responsible for this incident as well as compensation for users.

I am pretty sure that they have thought of possible situations like this and their legal team has made it clear in company documentations that Coinkite can't be held responsible for losses and unforeseen incidents. We will see but I am not optimistic. Perhaps they will settle out of court, if that's still an option, to avoid negative press and find a way to admit guilt without actually admitting that they did anything wrong.

[LoyceV]

I am pretty sure that they have thought of possible situations like this and their legal team has made it clear in company documentations that Coinkite can't be held responsible for losses and unforeseen incidents.

Even if this lawsuit is a success, how much money can they have? They didn't sell that many devices, they spent a lot, so I don't expect them to be sitting on even a fraction of the lost money.

[PrivacyG]

I have a question for the people who want maximum security for their Bitcoin and built them selves a SeedSigner or similar, why SeedSigner and not the classic offline airgapped computer with Electrum?

SeedSigner does seem very promising and the components are very accessible but after all, I decided that the best way to go is still the classic setup.  The Operating System is offline so there are no attack vectors to worry about and Electrum is probably the safest bet to place for some body who does not have the knowledge and abilites of Maxwell and want an option that is often looked through by experts.

After all.  I do not know for sure but I am assuming Electrum and Bitcoin Core are the all time most inspected pieces of Bitcoin software and the 'main' software used.  SeedSigner can have a lot less development all of a sudden due to a drop in interest and what not.  These projects always make me question how long will they last first of all, because they do seem to come and go all the time.

[avp2306]

The lawsuit is very well expected because such incident with massive and very severe losses for many people as customers of Coinkite can not be considered as nothing and Coinkite must be responsible for this incident as well as compensation for users.

I am pretty sure that they have thought of possible situations like this and their legal team has made it clear in company documentations that Coinkite can't be held responsible for losses and unforeseen incidents. We will see but I am not optimistic. Perhaps they will settle out of court, if that's still an option, to avoid negative press and find a way to admit guilt without actually admitting that they did anything wrong.

Even if they write those disclaimers, still the court will not going to accept that excuse, especially if the cause of those losses is due to their defective products.

This is the reason why many of those affected people sue them, because they know Coinkite fail miserably on what they promote to their clients as secure storage.

Whether they settle this or tried to fight those cases in court, this situation might became a test if those hardware wallet companies can escape on the liability. Especially if they put a disclaimer on their products.

[fillippone]

I am pretty sure that they have thought of possible situations like this and their legal team has made it clear in company documentations that Coinkite can't be held responsible for losses and unforeseen incidents.

Even if this lawsuit is a success, how much money can they have? They didn't sell that many devices, they spent a lot, so I don't expect them to be sitting on even a fraction of the lost money.

Even if they had a lot of money in their account, I bet the first things they did is to make that money to disappear.
They are of course liable or what happened for their users, no matter what they wrote anywhere, but they will be walking away almost untouched from any possible lawsuits.

[Pmalek]

I have a question for the people who want maximum security for their Bitcoin and built them selves a SeedSigner or similar, why SeedSigner and not the classic offline airgapped computer with Electrum?

The Seedsiger is the easier and more affordable route of the two. The individual components probably cost around $70. I know it was a device marketed to be under $50 back in the day but it's probably more now. If you don't have a spare computer/laptop laying around, you would have to buy one and use it only as your offline and airgapped signer. The initial investment is higher than that for the Seedsigner.

Then we have to look at the operating system on that airgapped computer. Sure, it can be Windows, but Linux is recommended. Not everyone has experience using a Linux distro and are perhaps not interested in learning just to use a bitcoin wallet on it. Then there is the recommendation that the airgapped computer shouldn't even possess the ability to connect to the internet and have no network card. The component is easier to remove from a desktop PC, but it's different for laptops and each laptop brand is different.