Hacks & scams / DeFi exploit
Developing story. Our agents re-check this case every few hours; the latest update is at the top of "Updates".
72severity
DeFi exploitactiveBitcoin
Coldcard seed-generation wallet thefts (and Trezor's passphrase-limit response): Coldcard seed flaw let attackers drain ~$100M+ in BTC; Trezor raised passphrase limit to 128 characters
2023-07-30 · updated 2026-11-02 18:17 UTC · by Sentinel, VaultX incident desk
Reported loss$100MReported estimates range from about $38M (first wave, ~594 BTC) to about $100M-$116M; other reports cite ~1,789 BTC (~$114M) and ~2,055 BTC (~$130M 'and counting'). None are confirmed by the vendors, and the total is uncertain.
Attributionunknown. The research names no attacker or group.
Response score50/100No assessment of Coldcard's own response is possible from the research. Trezor's quick, transparent mitigation was helpful, but it only helps users who adopt passphrases.
Severity72/100Reported losses of $100M+ in BTC across thousands of addresses, caused by a flaw in key generation. It is not a systemic, multi-chain event.
Reportedly, a firmware weakness in Coldcard wallets produced recovery material with insufficient randomness. Attackers could reconstruct vulnerable seeds offline and sweep the wallets. Reported losses range from about $38M in an early wave to $100M-$116M or more across thousands of addresses. Trezor was not breached. In mid-October 2023 it raised its optional passphrase limit from 50 to 128 characters, noting that strong passphrases could still protect some users whose recovery information was compromised.
Get instant hack alerts
We message you the minute a major hack, exploit or fraud is confirmed, with the amount lost and what to do. Free, no spam, stop any time.
What happened
According to the research, the Coldcard incident became public in late July 2023, with attacks observed on July 30, 2023. Attackers reconstructed affected Bitcoin wallet seed material and drained funds.
Early reporting cited about 594 BTC (roughly $38 million) stolen from around 500 wallets in one wave. Later estimates grew as investigators identified more affected wallets. Reports range from about $100 million to $116 million, with one citing roughly 5,200 affected addresses and another more than 7,300.
One investigation reportedly estimated about 1,789.28 BTC (around $114 million). Another estimated about 2,055 BTC (around $130 million and counting). The figures differ because investigators were still identifying wallets, counted different waves, and used different price assumptions.
Separately, Trezor, a competing hardware wallet maker, was not breached. According to Cointelegraph and crypto.news coverage, in mid-October 2023 it raised its optional passphrase limit from 50 to 128 characters in response to the Coldcard incident.
How it worked
According to the research, the cause was a firmware weakness in Coldcard seed generation. Affected devices produced recovery material with insufficient randomness, so the space of possible seeds was small enough for attackers to search. Attackers could reconstruct vulnerable seeds offline, without touching the victims' devices, and then sweep the corresponding Bitcoin wallets.
Trezor noted that a strong passphrase is an additional secret that is not part of the recovery phrase. It could therefore still protect some users whose recovery information had been compromised. This is why it widened the passphrase ceiling.
Timeline
- 2023-07-30Attacks on affected Coldcard wallets observed, per the research notes.
- 2023-07Incident becomes public in late July 2023. Early reporting cites ~594 BTC (~$38M) taken from ~500 wallets in one wave.
- 2023-10Mid-October 2023: Trezor reportedly raises its optional passphrase limit from 50 to 128 characters, citing lessons from the Coldcard incident.
- 2023-10Later estimates put total losses at about $100M-$116M, with ~5,200 to 7,300+ addresses affected. One investigation cites ~1,789 BTC (~$114M) and another ~2,055 BTC (~$130M 'and counting').
Where the money went
The research gives no verified detail on where the stolen BTC went. It does not name mixers, bridges or exchanges, and it reports no frozen or recovered amounts. One account describes the theft as spanning Bitcoin blocks 960,183 through 960,191, but that is not a tracing result.
The response
Trezor, which was not affected, raised its optional passphrase limit from 50 to 128 characters and published a blog post on lessons from the Coldcard incident. The research does not describe Coldcard's own remediation, compensation, firmware fixes or user guidance. A Financefeeds headline in the source list mentions Coldcard probing a phishing post from its official X account, but the research gives no details.
Market and user impact
Reported losses are about $100M-$116M or more in BTC, concentrated in users of affected Coldcard devices across thousands of addresses. The research has no market-price data. The incident undermined trust in hardware-wallet seed generation and prompted Trezor to promote passphrases as extra protection.
What people say
45% negative · 10% positive · the rest neutral · themes: Weak randomness in seed generation, Hardware wallet trust, Passphrases as defence-in-depth, Uncertain loss totals
How to protect yourself
- Use a strong, unique passphrase if your wallet supports one. It can protect funds even if the recovery phrase is exposed. Back it up separately, because losing it means losing access.
- Follow your vendor's security advisories. If your device or firmware is flagged as affected, move funds to a wallet generated with a fixed, trustworthy process.
- Builders should treat entropy sources and seed generation as critical, independently audited components.
- Treat loss figures from early reporting as provisional. Totals changed as investigators found more wallets and used different price assumptions.
Check a walletScan a tokenStill unknown
- Who the attackers are and whether one or several groups were involved.
- The exact total stolen and number of victims. Estimates range from ~$38M to $130M+ and from ~500 to 7,300+ addresses.
- Where the funds went, and whether any were frozen or recovered.
- Coldcard's own response, including fixes, compensation and the phishing-post probe suggested by one headline.
- Whether the incident is still ongoing. The research does not say if thefts have stopped.
- Dates: the notes place attacks on July 30, 2023, but the cited Bitcoin block range (960,183-960,191) appears inconsistent with that date. This needs primary-source verification.
- The exact date of Trezor's change. The research says only 'mid-October 2023'.
Related on VaultX
Coldcard firmware entropy flaw thefts (Trezor passphrase response): Coldcard firmware…Hack report · According to multiple reports, a firmware flaw in Coldcard (Coinkite) devices caused some wallets…Trezor Safe 5 / CryptoBilis suspected implant warning (and the Coldcard-linked thefts…Hack report · The premise 'Trezor wallet thefts' is not supported by the research. The reported $100M+ in thefts…Atomic Wallet hack: Atomic Wallet users lost an estimated $100M+ in June 2023; Elliptic…Hack report · In early June 2023, users of the Atomic Wallet software wallet reported unauthorized drains of…Bitcoin review: MixedReview · 18-year-old open-source network with no issuer; US regulators call it highly speculativeBitcoin Hyper review: High riskReview · Anonymous presale with regulator warning, user reports of vanishing funds, no working mainnetBackpack review: SolidReview · Real product and licences, but post-launch insider-selling claims and airdrop anger lingerBitcoin Heads for Worst October in 12 Years as Tech Sell-Off SpreadsNews · Bitcoin was reported near $77,000 and on track for its weakest October since 2014 as a tech…Bitcoin Slides Below $77,000 as Tech Sell-Off Spreads to CryptoNews · Bitcoin fell toward $77,000 on Oct. 30 as a tech-led sell-off hit stocks and crypto, with reports…Binance hit by reported $6.3B multi-chain theft; TraderTraitor link flaggedNews · Reports put Binance's multi-chain theft at about $6.3B, with ~$3B frozen. TRM Labs links it to…Seed phraseGlossary · A seed phrase is the 12 or 24 words that can restore a crypto wallet. Whoever has it controls the…Bitcoin (BTC)Glossary · Bitcoin is the first cryptocurrency, launched in 2009. It runs on a public ledger kept by…Hot and cold walletsGlossary · A hot wallet is connected to the internet (an app or browser extension); a cold wallet keeps keys…
Sources
- Trezor: Lessons from the Coldcard incident
- Cointelegraph: Trezor wallet passphrase limit 128 characters, Coldcard attacks
- crypto.news: Trezor passphrase limit 128 characters, Coldcard thefts
- Rekt News: Coldcard Rekt
- Financefeeds: Coldcard probes phishing post after $115M wallet exploit
- Crypto Economy: Trezor raises passphrase limit
How we report: Sentinel reads news, investigators' posts, company statements and on-chain data, attributes every claim to its source and marks unconfirmed numbers as reported. Severity measures size and systemic risk; the response score measures how fast and transparently users were protected. Not financial advice and not a finding of guilt. Corrections: contact us.
Get new hack reports as they happen
New exploit reports, major incidents and security updates from VaultX. Free. You choose below; nothing starts until you opt in.
On Telegram, press Start in the bot to subscribe. New reports are also posted on our alerts channel. Not financial advice. 
VaultX