Coldcard urges users to move bitcoin as exploit is still in progress

Coldcard urges users to move bitcoin as exploit is still in progress

The cold wallet maker said the flaw behind roughly $114 million in losses remains live, with specific models and firmware still exposed.

The developers of the Coldcard bitcoin wallet urged users to move their funds amid an exploit that has already drained as much as $114 million from self-custodied wallets. The vulnerability affects certain Mk3 devices set up on firmware 4.0.1 or later and Mk4, Mk5 and Q devices on older firmware. Wallets created using the dice-roll option are considered safe. The flaw, dormant in firmware since 2021, allows attackers to guess poorly randomized seed keys and drain funds, even as bitcoin’s price has remained near $63,800 despite the warning.

The developers behind the Coldcard wallet told users to urgently move their bitcoin BTC$63,778.44, confirming Tuesday that the exploit — which has drained as much as $114 million from self-custodied wallets — is still in progress.

"Please treat this as urgent. Migrate your funds," the company wrote, adding that the threat is active and asking users to warn holders who are "less online" and may not have seen the alert. Those are the wallets most exposed, since the fix has to be done by hand.

Please treat this as urgent. Migrate your funds. Follow the advisory for your model, upgrade your device, generate a new seed, and carefully move your funds.

Help spread the word, especially to people who are less online and may not see this update.

The threat is still ongoing. https://t.co/cbJxJles8x

— COLDCARD (@COLDCARDwallet) August 4, 2026

The warning is not precautionary. CoinDesk reported Monday that a possible fourth wave of sweeps ran throughout the day, taking roughly 449 BTC from 709 addresses on Galaxy Research's revised count and lifting cumulative losses from about $89 million to as much as $114 million.

The flaw traces to firmware that has sat dormant since 2021, in cases where a single key controls the funds with no second approval required.

The risk, which remains until users take action, is confined to specific devices and firmware. Owners of the Mk3, Coldcard's 2019 model, should move their funds now if the wallet was set up on firmware 4.0.1 or later. Mk4, Mk5 and Q owners on firmware below 5.6.0 or 1.5.0Q should update, create a new wallet and then move their coins across.

Coinkite has said the exception is anyone who used the device's dice option, where a user physically rolls dice at least 50 times and types in the results, and the wallet builds its key from those numbers instead of generating its own. Those wallets never touched the broken code and are safe.

A seed is the master key controlling a wallet's coins, so one produced with too little randomness, or entropy, can be guessed and regenerated by an attacker, who can then drain the wallet without ever touching the device.

Vincent Bouzon, director of product security at Ledger, which makes competing hardware wallets, said the incident was a failure of one implementation rather than a verdict on self-custody.

"Every wallet ultimately depends on a root secret generated from high-quality entropy," Bouzon told CoinDesk in an email, adding that the generation of that entropy "must be anchored in secure hardware, with an architecture that cannot silently downgrade to an untrusted software-based source."

He said the alternatives are worse, calling software wallets on non-secure hardware riskier still and saying that handing funds to a centralized exchange "isn't ownership, it's an IOU."

Bitcoin traded near $63,800 in early U.S. hours Tuesday, little moved following the wallet warning, per CoinDesk data.

UPDATE (Aug. 4, 12:10 UTC): Adds first reference to Bouzon in fourth-last paragraph.

1The bitcoin market has plenty of reasons to freak out, yet calm pervades51 minutes ago 2South African lawmakers propose draft rules on cross-border crypto transactions1 hour ago 3Bitcoin rises toward $64,000 as Coldcard exploit, Strategy sales recede. ADA advances1 hour ago 4BlackRock debuts tokenized access to $311 billion of money market funds in Europe2 hours ago 5First U.S. spot bitcoin ETF to close as inflows dwindle, investors chase AI returns2 hours ago 6Live updates: Bitcoin stuck in tight range as risk assets rise on Iran deal hopes3 hours ago 7Bhutan's GMC puts part of its bitcoin treasury to work after 10,000 BTC pledge4 hours ago 8Why Jim Cramer’s quantum panic isn’t rattling bitcoin as price holds steady around $64,0004 hours ago 9XRP holders can now borrow RLUSD on Ethereum through $280 million lending pool6 hours ago 10A new Solana proposal aims to ramp up daily SOL Burns from $47,000 to $650,0006 hours ago

The Evolution of the Crypto CEX Landscape: A Case Study on Binance

The Evolution of the Crypto CEX Landscape: A Case Study on Binance

Binance remains crypto’s leading exchange, expanding from spot and derivatives into RWAs, payments, savings, yield, and broader financial services.

Binance remains crypto’s leading exchange, expanding from spot and derivatives into RWAs, payments, savings, yield, and broader financial services.

Why it matters:

Binance remains crypto’s leading exchange, expanding from spot and derivatives into RWAs, payments, savings, yield, and broader financial services.

A new Solana proposal aims to ramp up daily SOL Burns from $47,000 to $650,000

Coldcard wallet losses may near $114 million as possible fourth sweep emerges

The future of crypto payments won't include on-ramps or bridges, Fun CEO says

The bitcoin market has plenty of reasons to freak out, yet calm pervades

South African lawmakers propose draft rules on cross-border crypto transactions

Bitcoin rises toward $64,000 as Coldcard exploit, Strategy sales recede. ADA advances