# Coldcard seed-generation wallet thefts (and Trezor's passphrase-limit response): Coldcard seed flaw let attackers drain ~$100M+ in BTC; Trezor raised passphrase limit to 128 characters
Source page: https://vaultx.llc/hacks/trezor-wallet-security-incident-october-2023 · VaultX incident report by Sentinel · first published 2026-11-02, updated 2026-11-02
- Date: 2023-07-30
- Reported loss: $100M (Reported estimates range from about $38M (first wave, ~594 BTC) to about $100M-$116M; other reports cite ~1,789 BTC (~$114M) and ~2,055 BTC (~$130M 'and counting'). None are confirmed by the vendors, and the total is uncertain.)
- Attribution: unknown. The research names no attacker or group.
- Chains: Bitcoin
- Status: developing
- Severity: 72/100
- Response score: 50/100 (No assessment of Coldcard's own response is possible from the research. Trezor's quick, transparent mitigation was helpful, but it only helps users who adopt passphrases.)
Reportedly, a firmware weakness in Coldcard wallets produced recovery material with insufficient randomness. Attackers could reconstruct vulnerable seeds offline and sweep the wallets. Reported losses range from about $38M in an early wave to $100M-$116M or more across thousands of addresses. Trezor was not breached. In mid-October 2023 it raised its optional passphrase limit from 50 to 128 characters, noting that strong passphrases could still protect some users whose recovery information was compromised.

**What happened**
According to the research, the Coldcard incident became public in late July 2023, with attacks observed on July 30, 2023. Attackers reconstructed affected Bitcoin wallet seed material and drained funds.
Early reporting cited about 594 BTC (roughly $38 million) stolen from around 500 wallets in one wave. Later estimates grew as investigators identified more affected wallets. Reports range from about $100 million to $116 million, with one citing roughly 5,200 affected addresses and another more than 7,300.
One investigation reportedly estimated about 1,789.28 BTC (around $114 million). Another estimated about 2,055 BTC (around $130 million and counting). The figures differ because investigators were still identifying wallets, counted different waves, and used different price assumptions.
Separately, Trezor, a competing hardware wallet maker, was not breached. According to Cointelegraph and crypto.news coverage, in mid-October 2023 it raised its optional passphrase limit from 50 to 128 characters in response to the Coldcard incident.

**How it worked**
According to the research, the cause was a firmware weakness in Coldcard seed generation. Affected devices produced recovery material with insufficient randomness, so the space of possible seeds was small enough for attackers to search. Attackers could reconstruct vulnerable seeds offline, without touching the victims' devices, and then sweep the corresponding Bitcoin wallets.
Trezor noted that a strong passphrase is an additional secret that is not part of the recovery phrase. It could therefore still protect some users whose recovery information had been compromised. This is why it widened the passphrase ceiling.

**Where the money went**
The research gives no verified detail on where the stolen BTC went. It does not name mixers, bridges or exchanges, and it reports no frozen or recovered amounts. One account describes the theft as spanning Bitcoin blocks 960,183 through 960,191, but that is not a tracing result.

**The response**
Trezor, which was not affected, raised its optional passphrase limit from 50 to 128 characters and published a blog post on lessons from the Coldcard incident. The research does not describe Coldcard's own remediation, compensation, firmware fixes or user guidance. A Financefeeds headline in the source list mentions Coldcard probing a phishing post from its official X account, but the research gives no details.

**Impact**
Reported losses are about $100M-$116M or more in BTC, concentrated in users of affected Coldcard devices across thousands of addresses. The research has no market-price data. The incident undermined trust in hardware-wallet seed generation and prompted Trezor to promote passphrases as extra protection.

**Timeline**
- 2023-07-30 Attacks on affected Coldcard wallets observed, per the research notes.
- 2023-07 Incident becomes public in late July 2023. Early reporting cites ~594 BTC (~$38M) taken from ~500 wallets in one wave.
- 2023-10 Mid-October 2023: Trezor reportedly raises its optional passphrase limit from 50 to 128 characters, citing lessons from the Coldcard incident.
- 2023-10 Later estimates put total losses at about $100M-$116M, with ~5,200 to 7,300+ addresses affected. One investigation cites ~1,789 BTC (~$114M) and another ~2,055 BTC (~$130M 'and counting').

**How to protect yourself**
- Use a strong, unique passphrase if your wallet supports one. It can protect funds even if the recovery phrase is exposed. Back it up separately, because losing it means losing access.
- Follow your vendor's security advisories. If your device or firmware is flagged as affected, move funds to a wallet generated with a fixed, trustworthy process.
- Builders should treat entropy sources and seed generation as critical, independently audited components.
- Treat loss figures from early reporting as provisional. Totals changed as investigators found more wallets and used different price assumptions.

**Still unknown**
- Who the attackers are and whether one or several groups were involved.
- The exact total stolen and number of victims. Estimates range from ~$38M to $130M+ and from ~500 to 7,300+ addresses.
- Where the funds went, and whether any were frozen or recovered.
- Coldcard's own response, including fixes, compensation and the phishing-post probe suggested by one headline.
- Whether the incident is still ongoing. The research does not say if thefts have stopped.
- Dates: the notes place attacks on July 30, 2023, but the cited Bitcoin block range (960,183-960,191) appears inconsistent with that date. This needs primary-source verification.
- The exact date of Trezor's change. The research says only 'mid-October 2023'.

**Sources**
- Trezor: Lessons from the Coldcard incident https://trezor.io/es/blog/insights/lessons-from-the-coldcard-incident
- Cointelegraph: Trezor wallet passphrase limit 128 characters, Coldcard attacks https://cointelegraph.com/news/trezor-wallet-passphrase-limit-128-characters-coldcard-attacks
- crypto.news: Trezor passphrase limit 128 characters, Coldcard thefts https://crypto.news/trezor-passphrase-limit-128-characters-coldcard-thefts/
- Rekt News: Coldcard Rekt https://rekt.news/zh/coldcard-rekt
- Financefeeds: Coldcard probes phishing post after $115M wallet exploit https://financefeeds.com/coldcard-probes-phishing-post-from-official-x-account-after-115m-wallet-exploit/
- Crypto Economy: Trezor raises passphrase limit https://crypto-economy.com/trezor-raises-passphrase-limit/

---
VaultX: free crypto news and intelligence, https://vaultx.llc