Coldcard firmware exploit allegedly drains $89M in Bitcoin, exposes hardware testing gaps and transfer fixes

Hackers are reported to have exploited a Coldcard firmware flaw to steal about $89 million in Bitcoin from thousands of wallets, according to Crypto Briefing. The incident is being framed as a test of hardware wallet firmware security practices and the risks of trust assumptions in custody workflows ^[1].

Crypto reporting also points to a hardware wallet testing gap behind the vulnerability. Cointelegraph quotes Kraken’s security chief saying auditors verified that the intended random number generator existed, but did not confirm it was being called—allowing the issue to persist for roughly five years. Related coverage emphasizes how the failure in test coverage contributed to the exploit’s survival ^{[2] [3]}.

Separate reporting discusses user-facing consequences tied to the exploit, including how some users may be able to stop pending transfers and the role of potentially replaceable unconfirmed transactions through RBF, alongside claims that some stolen Bitcoin may have reached “second-hop” addresses ^[4].

The reported Coldcard firmware incident highlights both the severity of the theft and shortcomings in how critical hardware wallet behavior is validated, according to the cited coverage ^{[1] [2]}.